DIMVA 2019 On the Perils of Leaking Referrers in Online - PowerPoint PPT Presentation

DIMVA 2019 On the Perils of Leaking Referrers in Online Collaboration Services Authors: Beliz Kaleli Manuel Egele Gianluca Stringhini bkaleli@bu.edu megele@bu.edu gian@bu.edu

Online Collaboration Services (OCSs) File operations; ▪ Upload/Create ▪ View/Edit online Online ▪ Share Collaboration Services Beliz Kaleli 2

Sharing a File on an OCS Upload secret location: or Create Share https://www.ocs-name.com/ < UniqueIdentifier > } OCS Ideally unguessable Beliz Kaleli 3

This year McAfee reported that; “8% of shared files contain sensitive data” [1] ▪ OCS Files, used by individuals and companies, can contain sensitive information . [1] Where cloud files are shared. [1] https://www.skyhighnetworks.com/cloud-computing-trends-2019/ Beliz Kaleli 4

Introduction We show that: The secret location of OCS files can be leaked by the improper handling of links embedded in these files. ▪ 21 OCS are analyzed on 6 different web browsers Beliz Kaleli 5

Background - HTTP Referer ▪ HTTP Request Header that identifies the URI from which the request originated. Request Headers Value http://ocs.com/file1 HTTP Accept text/html, application/xhtml+xml Request Accept-Encoding gzip, deflate Accept-Language en-US, en; q=0.5 -------------- Connection keep-alive -------------- -------------- DNT 1 -------------- Host ocs.com Referer http://ocs.com/file1 User-Agent Mozilla/5.0 (X11; Linux x86_64) Beliz Kaleli 6

Background - HTTP Referer Purpose: ▪ Personalize the website: provide specific help, suggest relevant pages to targeted users ▪ Generate special offers ▪ Webpage analytics (e.g., analyzing where most of the traffic is coming from) ▪ Block visitors from specific domains The HTTP Referer field is configurable with the Referrer Policy [1] [1] W3C Candidate Recommendation referrer policy. https://www.w3.org/TR/referrer-policy/. Beliz Kaleli 7

Background - Existing Mitigations ● "no-referrer" ● "no-referrer-when-downgrade" ● "same-origin" ▪ Referrer Policy ● "origin" ● "strict-origin" ● "origin-when-cross-origin" ▪ HTML Link Type ● "strict-origin-when-cross-origin" (i.e. rel=”noreferrer”) ● "unsafe-url" HTTP Referer Referrer Structure No Referrer - ASCII Serialized http(s)://www.service-name.com/ Full Referrer http(s)://www.service-name.com/<UniqueIdentifier> Beliz Kaleli 8

Attack Model maggi.cc Eve Beliz Kaleli 9

Attack Model secret maggi.cc URL Eve Beliz Kaleli 10

Attack Model secret URL secret maggi.cc URL Eve Beliz Kaleli 11

Attack Model secret URL secret maggi.cc Referrer: secret URL URL Eve Beliz Kaleli 12

Attack Model secret URL secret maggi.cc Referrer: secret URL URL maggi.cc Eve Beliz Kaleli 13

Alice: Upload/Create file Beliz Kaleli 14

Alice: Share file https://docs.google.com/document/d /17AA7PNbyu94pHe8QxKHKq8SsK PuLZV-9-ZrWvV-k45o/edit?usp=sha ring Beliz Kaleli 15

Bob: Visit link Beliz Kaleli 16

Implementation - Methodology To test our attack model on real-world OCSs: 1. Identifying relevant services 2. Creating files 3. Sharing files 4. Examining the referrer Beliz Kaleli 17

Implementation - Identifying Relevant Services ▪ We obtained the most popular services by Google queries and crawling Alexa lists ▪ Top/Computers/Internet/File_Sharing ▪ Top/Computers/Internet/On_the_Web/Web_Applications/Storage ▪ Test manually: --------------------- -------------------o ▪ Setup an account ur-server.com ▪ Upload/Create file with link to our server ------------------- --------------------- ▪ Check if clickable ------------------- ▪ Check if shareable via a URL Uploaded file Beliz Kaleli 18

Implementation - Creating Files ▪ Created different types of files: “.doc”, “.docx”, “.pdf”, “.xls”, “.xlsx”, “.ppt”, “.pptx”, “.note”, etc. Embedded Our web HTTP headers are logged URL server Beliz Kaleli 19

Implementation - Sharing Files Relevant OCSs = File Hosting Services + Instant Messaging Services For file hosting services and instant messaging services; ▪ Shared through links which are editable or view-only For some instant messaging services; (e.g., Flock) ▪ File sent directly to chat between two accounts Beliz Kaleli 20

Implementation - Examining Referrers Alice OCS --------------------- -------------------o ur-server.com Share Upload ------------------- secret URL --------------------- ------------------- Beliz Kaleli 21

Implementation - Examining Referrers Alice OCS --------------------- -------------------o ur-server.com Share Upload ------------------- secret URL --------------------- ------------------- Beliz Kaleli 22

Implementation - Examining Referrers Bob our-server Click on --------------------- embedded Collect Referrer -------------------o link Visit link URL from output ur-server.com secret URL of script ------------------- --------------------- ------------------- Beliz Kaleli 23

Implementation - Examining Referrers Bob our-server Click on --------------------- embedded Collect Referrer -------------------o link Visit link URL from output ur-server.com secret URL of script ------------------- --------------------- ------------------- Beliz Kaleli 24

Implementation - Examining Referrers Bob our-server Click on --------------------- embedded Collect Referrer -------------------o link Visit link URL from output ur-server.com secret URL of script ------------------- --------------------- ------------------- Beliz Kaleli 25

Implementation - Examining Referrers Visit recorded Referrer URL Beliz Kaleli 26

Implementation - Examining Referrers Visit recorded Referrer URL File is NOT accessed Beliz Kaleli 27

Implementation - Examining Referrers Visit recorded Referrer URL File is NOT accessed Secret URL is NOT leaked Beliz Kaleli 28

Implementation - Examining Referrers Visit recorded Referrer URL File is NOT File is accessed accessed Secret URL is NOT leaked Beliz Kaleli 29

Implementation - Examining Referrers Visit recorded Referrer URL File is NOT File is accessed accessed Secret URL Secret URL is NOT leaked is leaked Beliz Kaleli 30

Referrer Policy First Public Draft (2014): Working Draft (2016): ▪ "none" ▪ "no-referrer" ▪ "none-when-downgrade" ▪ "no-referrer-when-downgrade" ▪ "origin-only" ▪ "same-origin" ▪ "origin-when-cross-origin" ▪ "origin" ▪ "unsafe-url" ▪ "origin-when-cross-origin" ▪ "unsafe-url" Beliz Kaleli 31

Referrer Policy First Public Draft (2014): Working Draft (2016): ▪ "none" ▪ "no-referrer" ▪ "none-when-downgrade" ▪ "no-referrer-when-downgrade" ▪ "origin-only" ▪ "same-origin" ▪ "origin-when-cross-origin" ▪ "origin" ▪ "unsafe-url" ▪ "strict-origin" ▪ "origin-when-cross-origin" ▪ "strict-origin-when-cross-origin" ▪ "unsafe-url" Currently a Candidate Recommendation Beliz Kaleli 32

Evaluation - Common Insights Reasons behind vulnerabilities; ▪ Referrer Policy is not set by the OCS ▪ Referrer Policy option is not Services secure enough ▪ Different behavior on mobile and desktop browsers ▪ Edge and iOS Safari support Browsers older draft of Referrer Policy Beliz Kaleli 33

Evaluation 7/21 Vulnerable : Vulnerable : Not vulnerable : N/A Beliz Kaleli 34

Evaluation ▪ Edge and iOS Safari supports older draft of Referrer Policy e.g., Overleaf ▪ "origin-when-cross-origin" → Overleaf changed to "no-referrer" and added "rel=noreferrer" → No longer vulnerable Beliz Kaleli 35

Evaluation ▪ Different behaviors on desktop and mobile browsers ▪ PDF.js removes referrers, built-in mechanisms may not e.g., Box ▪ Desktop browsers - PDF.js (removes referrers in requests) ▪ Mobile browsers - native PDF viewer (no referrer removal) ▪ "no-referrer-when-downgrade" Vulnerable: HTTPS → HTTPS ▪ Beliz Kaleli 36

Evaluation ▪ Referrer Policy is not set by the OCS e.g., Onehub, Linkedin Slideshare, Evernote Fallback to "no-referrer-when-downgrade" ▪ Vulnerable: HTTPS → HTTPS ▪ Beliz Kaleli 37

Adoption of Referrer Policy ▪ First 100K of lists : less safe option Beliz Kaleli 38

Countermeasures User Provider ▪ Configure browser settings ▪ Trim HTTP Referer to only ▪ Use browser extensions display the hostname ▪ Use private browsing mode ▪ Use rel=”noreferrer” (on Firefox) ▪ Redirect links inside documents Beliz Kaleli 39

Future Steps ▪ Analyze different browsers and OCSs ▪ Investigate whether this vulnerability is known ▪ Embed links to several real-world websites ▪ Analyze the use of information ▪ Fill files with fake sensitive data Beliz Kaleli 40