g o t y o u r no s e
play

( G O T Y O U R NO S E ) ( How Attackers steal your - PowerPoint PPT Presentation

( G O T Y O U R NO S E ) ( How Attackers steal your precious Data without using Scripts ) A Presentation by Mario Heiderich ~ Hack in Paris 2012 ( g o t y o u r no s e ) ( O u r D e a r S p e a k e r) Dr.


  1. ( G O T Y O U R NO S E ) ( How Attackers steal your precious Data without using Scripts ) A Presentation by Mario Heiderich ~ Hack in Paris 2012 ( g o t y o u r no s e )

  2. ( O u r D e a r S p e a k e r)  Dr. Mario Heiderich  Twitter @0x6D6172696F  Researcher and PhD Student, Ruhr-Uni Bochum  Thesis on Client Side Security and Defense  Security Researcher contracting for MS, Redmond  Founder of Cure53 Penetration Test Firm  Published author and international speaker  Specialized in HTML5 and SVG Security  JavaScript, XSS and Client Side Attacks  FUD Peddler and Prophet of Doom  HTML5 Security Cheatsheet ( g o t y o u r no s e )

  3. ( B a c k g ro u nd ) ( g o t y o u r no s e )

  4. ( C ro s S ) ( S i t e S c ri p t i ng )  Lots of Talks have been held  Plenty of Research has been done  Traditional injections  Attacks from outer space  XSS, XAS, XDS, XSSQLI, SWXSS, … you name it!  Defense mechanisms on multiple layers  Network, Server, Client and what not...  CSP , NoScript, AntiSamy and HTMLPurifier, Browser XSS Filters  mod_security, PHPIDS, some nonsense WAF products  But why use scripting at all? ( g o t y o u r no s e )

  5. ( T o p i c s T O D A Y )  Scriptless Attacks in your Browser  Attacks bypassing NoScript  Attacks bypassing C ontent S ecurity P olicy  No Scripting allowed  No Scripting necessary  Attacks working in Thunderbird  Attacks stealing your data without XSS ( g o t y o u r no s e )

  6. ( O f f e ns i v e T a l k )  We'll mainly see attack vectors today  Starting simple – using cheap HTTP tricks  Stealing passwords with CSS  Almost like the Sexy Assassin back in 2009  Just without any bruteforcing  Playing with a user's perception  Time and Measure, Log and Steal  Focus is stealing data by using the browser  Passwords, tokens, sensitive data is general ( g o t y o u r no s e )

  7. ( T h e ) ( M a rk u p B ro t h e rs ) ( S V G S a nc h e z ) ( H T M L H a rry ) ( C l i v e S S t y l e s h e e t ) ( g o t y o u r no s e )

  8. ( A ri v e r f o r s o m e ) ( g o t y o u r no s e )

  9. ( D e f e ns e )  Defense is possible but tough  Benign features combined to be attacks  No possibility to easily build signatures  Attacker utilizes solicited content  CSS, SVG images, Links and Images  No scripting allowed!  „Thanks for the injection!“ ( g o t y o u r no s e )

  10. ( H a p p y I nj e c t i o ns ) ( g o t y o u r no s e )

  11. ( E x p l o i t s )  Three Chapters to be presented  Chapter 1: The simple tricks  Chapter 2: Advanced Class  Chapter 3: For Science! ( g o t y o u r no s e )

  12. ( C h a p t e r o ne ) < Those simple Tricks > ( g o t y o u r no s e )

  13. ( A l i c e a nd t h e c a p t c h a )  Let's assume the following situation  Alice visits a website she frequently uses  She has a login there, password stored  Let's further assume her password is „secret“  The site seems to have a new security feature!  Now the login needs a CAPTCHA to be solved  And that is how it looks like! ( g o t y o u r no s e )

  14. ( C A P C T H A O f d o o m )  Seems legit?  See it live: http://heideri.ch/opera/captcha/ ( g o t y o u r no s e )

  15. ( a na l y s i s )  What really happens  The attacker, Clive, injects CSS...  input[type=password]{content:attr(value)}  Then he includes a custom SVG font  @font-face {font-family: X;src: url(x.svg#X) format("svg");}  The attacker simply flips characters  s becomes x , e becomes w , c becomes @ …  By thinking it's a CAPTCHA...  … Alice submits her password to the attacker ( g o t y o u r no s e )

  16. ( v a l i d a t i o n) ( g o t y o u r no s e )

  17. ( c s s a nd re g e x )  Old but gold – brute-forcing passwords  But this time with CSS3 and HTML5  The secret ingredient here is „validation“  Brute-force with RegEx!  Let's have a look  DEMO  Good thing it works on all browsers  Limited by smart password managers though ( g o t y o u r no s e )

  18. ( C h a p t e r T WO ) Advanced Class > < ( g o t y o u r no s e )

  19. ( I re a d y o u )  Bob is security aware  His online banking webite? No scripts allowed!  His browser? Top-up-to-date!  His emails? PGP , SMIME – you name it!  Bob isolates stuff, knows his security  Even if an attacker XSS'd his bank website...  Nothing could happen – no JavaScript, Flash or Java  How can we still pwn Bob then? ( g o t y o u r no s e )

  20. ( s m a rt b o b ) ( g o t y o u r no s e )

  21. ( d e f i ne g o a l s )  We cannot XSS Bob  We cannot easily get his cookies  Neither simply access sensitive data  But we want his login data  So we oughta „jack“ the login form! ( g o t y o u r no s e )

  22. ( D i rna m e I nj e c t i o n)  If Bob used Chrome, it'd be gotcha ! ( g o t y o u r no s e )

  23. ( L e g i t o r no t )  DEMO http://html5sec.org/dirname  Looked legit – or did it?  So what happened here?  We have one injected attribute  That's HTML5 dirname – a Unicode „helper“  dirname sets a field to a value depending on a Unicode code-point in a different field  But it also overwrites existing form field values.  In case the names match  Like.. WTF!? ( g o t y o u r no s e )

  24. ( L u c k y b o b )  He uses Firefox with NoScript  ...and Thunderbird with Enigmail  Unpwnable? ( g o t y o u r no s e )

  25. Re b u t t a l  Let's stay admantine  And develop a targeted exploit  Working on Firefox and Thunderbird  Latest versions, bypassing NoScript How can we do that?  And can we do it at all?  Let's have a look! ( g o t y o u r no s e )

  26. ( k e y l o g g e r)  Just a harmless login page  Behaving strange on closer inspection though...  Let's check that http://html5sec.org/keylogger ( g o t y o u r no s e )

  27. ( L e a v i ng l a s v e g a s )  If it works in Firefox w/o JavaScript  Can it also work in... ( g o t y o u r no s e )

  28. ( t h u nd e rb i rd )  Mother of God!  Stealing and exfiltrating keystrokes  Right in your favorite email client  Demo time! ( g o t y o u r no s e )

  29. ( H o w i s i t d o ne )  Attacker injected some inline SVG code  SVG knows the <set> element  The <set> element can listen to events  Even keystrokes  The feature is called accessKey() (W3C)  JavaScript is turned off – it's „no script“ anyway  But the keystroke scope is hard to define  In Firefox it's the whole document ( g o t y o u r no s e )

  30. ( t h a nk s s v g s a nc h e z ) Now, what's next? ( g o t y o u r no s e )

  31. <l e t s t a k e a b re a t h > ( g o t y o u r no s e )

  32. ( C h a p t e r t h re e ) < For Science !!! > ( g o t y o u r no s e )

  33. ( C S RF T o k e ns )  Everybody knows CSRF  One domain makes a request to another  The user is logged into that other domain  Stuff happens, accounts get modified etc.  How to we kill CSRF?  Easily – we use tokens, nonces  We make sure a request cannot be guessed  Or brute-forced – good tokens are long and safe ( g o t y o u r no s e )

  34. C S RF a nd X S S  CSRF and XSS are good friends  JavaScript can read tokens from the DOM  Bypass most CSRF protection techniques  But can we steal CSRF tokens w/o JS? ( g o t y o u r no s e )

  35. ( A l re a d y d o ne )  SDC, Gaz and thornmaker already did it  Check out http://p42.us/css/  They used CSS  Basically a brute-force via attribute selectors  input[value^=a]{background:url(?a)}  If the server catches GET /?a...  The first character is an a  But then what?  There's no „second or Nth character selector“  They had to go input[value^=aa]{background:url(?aa)} ( g o t y o u r no s e )

  36. ( e f f e c t i v e ne s s )  We're attackers who don't have much time!  So we cannot bruteforce like that  We need a quicker approach!  Also, this time we want to attack Webkit :-)  Let's cook ourselves some crazy CSS! ( g o t y o u r no s e )

  37. ( i ng re d i e nt s )  Some links with a secret CSRF token  A CSS injection  height  width  content:attr(href)  overflow-x:none  font-family  And another secret ingredient ( g o t y o u r no s e )

  38. ( D E M O )  http://html5sec.org/webkit/test ( g o t y o u r no s e )

Recommend


More recommend