Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking - PowerPoint PPT Presentation

Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking Your Secrets Avinash Sudhodanan Soheil Khodayari Juan Caballero 24/02/2020, NDSS 2020

COSI Attack A malicious web site infers the state of a user (the victim) at another web site Alice (victim) 2

COSI Attack A malicious web site infers the state of a user (the victim) at another web site Alice (victim) Web Browser 3

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Alice (victim) Web Browser 4

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Paper Paper Alice #278 #997 (victim) Web Browser 5

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Paper Paper Alice #278 #997 (victim) Malice (Attacker) Web Browser 6

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Paper Paper Alice #278 #997 (victim) Malice (Attacker) Web Browser 7

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Paper Paper Alice #278 #997 (victim) Hi Alice, Click here to finalize Malice your reviews for FOO (Attacker) con Web Browser 8

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Paper Paper Alice #278 #997 (victim) mal-site.com Hi Alice, Click here to finalize Malice your reviews for FOO (Attacker) con Web Browser 9

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com Paper Paper Alice infer state #278 #997 (victim) mal-site.com Hi Alice, Click here to finalize Malice your reviews for FOO (Attacker) con Web Browser 10

COSI Attack A malicious web site infers the state of a user (the victim) at another web site foo.hotcrp.com What does it mean by inferring Paper Paper state at foo.hotcrp.com Alice infer state #278 #997 (victim) mal-site.com Hi Alice, Click here to finalize Malice your reviews for FOO (Attacker) con Web Browser 11

States foo.hotcrp.com mal-site.com COSI Attack: infer state ● Attacker’s goal: infer states ● Known by different names Alice (victim) Web Browser Login Detection, Login Logged In Logged Out Login Oracle Account Type Reviewer Author Admin Owns a review of Does not own a review of Content Ownership paper #278 paper #278 Owns the account Does not own the account Account Ownership Deanonymization user217 user217 12

State-dependent URLs (SD-URLs) URLs returning different responses depending on the requesting browser’s state SD-URL : https://foo.hotcrp.com/api.php/review?p=278 13

State-dependent URLs (SD-URLs) URLs returning different responses depending on the requesting browser’s state SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response 14

State-dependent URLs (SD-URLs) URLs returning different responses depending on the requesting browser’s state SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response Logged In Reviewer Reviews paper #278 15

State-dependent URLs (SD-URLs) URLs returning different responses depending on the requesting browser’s state SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 16

State-dependent URLs (SD-URLs) URLs returning different responses depending on the requesting browser’s state SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 17

State-dependent URLs (SD-URLs) foo.hotcrp.com mal-site.com infer state foo.hotcrp.com/api.php/review?p=278 State-dependent response SOP Alice (victim) foo.hotcrp.com Web Browser SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 18

XS-Leaks Browser side-channels for inferring the response of cross-origin requests Leak Type References Events-Fired [Grossman2006Blog, Goethem2015CCS, Cardwell2011Blog, ..] Object-Properties [Grossman2012Blog, Schwenk2017USENIX, Masas2018Blog..] JS-Error [Grossman2006Blog, Shiflett2006Blog] CSS-Properties [Evans2008Blog] CSP-Violation [Homakov2013Blog, Gulyas2018WPES] Timing [Bortz2007WWW, Evans2009Blog, Goethem2015CCS, ..] AppCache [Lee2015NDSS] 19

Events Fired XS-Leak foo.hotcrp.com mal-site.com <embed infer state foo.hotcrp.com/api.php/review?p=278 src= SD-URL onload=revwr() code = 200 Alice (victim) onerror=notRevwr() > foo.hotcrp.com Web Browser SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 20

Events Fired XS-Leak foo.hotcrp.com mal-site.com <embed infer state foo.hotcrp.com/api.php/review?p=278 src= SD-URL onload=revwr() code = 403 Alice (victim) onerror=notRevwr() > foo.hotcrp.com Web Browser SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 21

Multiple States, Same Response SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 22

Multiple States, Same Response SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 code = 200 Logged Out 23

Multiple States, Same Response foo.hotcrp.com mal-site.com <embed infer state foo.hotcrp.com/api.php/review?p=278 src= SD-URL onload=revwr() Response Alice (victim) onerror=notRevwr() > foo.hotcrp.com Web Browser SD-URL : https://foo.hotcrp.com/api.php/review?p=278 State Response code = 200 Logged In Reviewer Reviews paper #278 code = 403 Logged In Reviewer Not review paper #278 code = 200 Logged Out 24

Same Attack Payload, Browser-specific Behavior The same XS-Leak payload may work differently on different browsers foo.hotcrp.com mal-site.com <embed infer state foo.hotcrp.com/api.php/review?p=278 src= SD-URL onload=revwr() 200 Alice (victim) onerror=notRevwr() > foo.hotcrp.com foo.hotcrp.com mal-site.com <link infer state foo.hotcrp.com/api.php/review?p=278 href= SD-URL onload=revwr() 200 onerror=notRevwr() Alice (victim) rel = stylesheet> foo.hotcrp.com 25

Attack Classes 26

Attack Classes Name : 27

Attack Classes Name SD-URL Responses Response A Response B : 28

Attack Classes Name SD-URL Responses XS-Leak Response A Response B Inclusion Manifest. : 29

Attack Classes Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge : 30

Attack Classes Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge ✓ ✓ ✓ EF- code = 200 code = 4xx || 5xx <script> onload / StatusErro content-type = onerror rScript text/javascript : 31

Attack Classes Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge ✓ ✓ ✓ EF- code = 200 code = 4xx || 5xx <script> onload / StatusErro content-type = onerror rScript text/javascript : 32

Attack Classes Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge ✓ ✓ ✓ EF- code = 200 code = 4xx || 5xx <script> onload / StatusErro content-type = onerror rScript text/javascript ● 40 attack classes ● 21 new attack classes ● 1 completely novel XS-Leak (based on postMessage API) 33

New XS-Leak: postMessage broadcasts ● SD-URL property State Response A Broadcasts message “x” B Broadcasts message “y” foo.hotcrp.com mal-site.com infer state window.open(SDURL) Alice (victim) 34

New XS-Leak: postMessage broadcasts ● SD-URL property State Response A Broadcasts message “x” B Broadcasts message “y” foo.hotcrp.com mal-site.com mal-site.com infer state window.open(SDURL) postmessage(“x”, *) Alice (victim) 35

New XS-Leak: postMessage broadcasts ● SD-URL property State Response A Broadcasts message “x” B Broadcasts message “y” foo.hotcrp.com mal-site.com mal-site.com infer state window.open(SDURL) state = A if rcvMsg === “x”{ postmessage(“x”, *) state = “A” Alice (victim) } 36