web security model
play

Web security model Nadia Heninger and Deian Stefan Some slides - PowerPoint PPT Presentation

Mar 21, 2024 •29 likes •1.27k views

CSE 127: Computer Security Web security model Nadia Heninger and Deian Stefan Some slides adopted from Zakir Durumeric, Dan Boneh, and Kirill Levchenko Lecture objectives Basic understanding of how the web works Understand relevant

  1. Sending cookie with each request GET /index.html HTTP/1.1 
 Accept: image/gif, image/x-bitmap, image/jpeg, */* Accept-Language: en Connection: Keep-Alive User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Cookie: trackingID=3272923427328234 Cookie: userID=F3D947C2 Host: www.example.com Referer: http://www.google.com?q=dingbats

  2. Basic browser execution model • Each browser window…. ➤ Loads content ➤ Parses HTML and runs Javascript ➤ Fetches sub resources (e.g., images, CSS, Javascript) ➤ Respond to events like onClick, onMouseover, 
 onLoad, setTimeout

  3. Nested execution model • Windows may contain frames from different sources ➤ Frame: rigid visible division ➤ iFrame: floating inline frame • Why use frames? https://a.com ➤ Delegate screen area to content from another source ➤ Browser provides isolation based on frames b.com d.com ➤ Parent may work even if frame is broken c.com a.com

  4. Nested execution model • Windows may contain frames from different sources ➤ Frame: rigid visible division ➤ iFrame: floating inline frame • Why use frames? ➤ Delegate screen area to content from another source ➤ Browser provides isolation based on frames ➤ Parent may work even if frame is broken

  5. Document object model (DOM) • Javascript can read and modify page by interacting with DOM ➤ Object Oriented interface for reading and writing website content • Includes browser object model ➤ Access window, document, and other state like history, browser navigation, and cookies

  6. Modifying the DOM using JS <html> <body> <ul id=“t1”> <li>Item 1</li> </ul> ... </body> </html>

  7. Modifying the DOM using JS <html> <body> <ul id=“t1”> <li>Item 1</li> </ul> ... </body> </html> <script> const list = document.getElementById(‘t1'); 
 const newItem = document.createElement(‘li’); const newText = document.createTextNode(‘Item 2’); list.appendChild(newItem); newItem.appendChild(newText) </script>

  8. Modifying the DOM using JS <html> <body> <ul id=“t1”> <li>Item 1</li> </ul> ... </body> </html> <script> const list = document.getElementById(‘t1'); 
 const newItem = document.createElement(‘li’); const newText = document.createTextNode(‘Item 2’); list.appendChild(newItem); newItem.appendChild(newText) </script>

  9. Modern websites are complicated

  10. Modern websites are complicated The LA Times homepage includes 540 resources from nearly 270 IP addresses, 58 networks, and 8 countries Many of these aren’t controlled by the main sites.

  12. Modern websites are complicated Google analytics Framed ad jQuery library Local scripts Extensions Third party ad

  13. Lecture objectives • Basic understanding of how the web works • Understand relevant attacker models • Understand browser same-origin policy

  14. Relevant attacker models Network attacker http://example.com http://example.com

  15. Relevant attacker models Network attacker http://example.com http://example.com Web attacker https://evil.com evil.com https://evil.com

  16. Relevant attacker models Gadget attacker Web attacker with capabilities to inject limited content into honest page https://example.com example.com

  17. Relevant attacker models Gadget attacker Web attacker with capabilities to inject limited content into honest page https://example.com evil.com example.com

  18. Relevant attacker models Gadget attacker Web attacker with capabilities to inject limited content into honest page https://example.com evil.com example.com

  19. Relevant attacker models Gadget attacker Web attacker with capabilities to inject limited content into honest page https://example.com evil.com example.com

  20. Relevant attacker models Gadget attacker Web attacker with capabilities to inject limited content into honest page https://example.com evil.com example.com

  21. Most of our focus: web attacker model https://evil.com evil.com https://evil.com

  22. And variants of it example.com evil.com evil.com example.com example.com evil.com

  23. Web security • Safely browse the web in the presence of web attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 keypassx 
 skype 
 4chan.org bank.ch Cookies/HTML5 local storage Filesystem

  24. Web security • Safely browse the web in the presence of web attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 keypassx 
 skype 
 4chan.org bank.ch Cookies/HTML5 local storage Filesystem

  25. Web security • Safely browse the web in the presence of web attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 VM + UIDs + seccomp-bpf keypassx 
 skype 
 4chan.org bank.ch Cookies/HTML5 local storage Filesystem UIDs + ACLs

  26. Web security • Safely browse the web in the presence of web attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 VM + UIDs + seccomp-bpf keypassx 
 skype 
 4chan.org bank.ch Cookies/HTML5 local storage Filesystem UIDs + ACLs

  27. Web security • Safely browse the web in the presence of web attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 VM + UIDs + SOP seccomp-bpf keypassx 
 skype 
 4chan.org bank.ch Cookies/HTML5 local storage Filesystem UIDs + ACLs SOP

  28. Same origin policy (SOP) • Origin: isolation unit/trust boundary on the web ➤ (scheme, domain, port) triple derived from URL • SOP goal: isolate content of different origins ➤ Confidentiality: script contained in evil.com should not be able to read data in bank.ch page ➤ Integrity: script from evil.com should not be able to modify the content of bank.ch page

  29. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  30. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  31. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com ✗ (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  32. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com ✗ ✗ (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  33. 
 
 
 How do you communicate with frames? • Message passing via postMessage API ➤ Sender: 
 targetWindow.postMessage(message, targetOrigin); ➤ Receiver: 
 window.addEventListener("message", receiveMessage, false); function receiveMessage(event){ if (event.origin !== "http://example.com") return; … }

  34. SOP for HTTP responses • Pages can perform requests across origins ➤ SOP does not prevent a page from leaking data to another origin by encoding it in the URL, request body, etc. • SOP prevents code from directly inspecting HTTP responses ➤ Except for documents, can often learn some information about the response

  35. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,a.com,443) (https,b.com,443)

  36. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,a.com,443) (https,b.com,443)

  37. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,a.com,443) (https,b.com,443)

  38. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,b.com,443) (https,a.com,443) (https,b.com,443)

  39. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com ✗ (https,b.com,443) (https,a.com,443) (https,b.com,443)

  40. Scripts • Can load scripts from across origins • Scripts execute with privileges of the page • Page can see source via 
 func.toString() https://a.com (https,a.com,443) (https,a.com,443)

  41. Scripts • Can load scripts from across origins • Scripts execute with privileges of the page • Page can see source via 
 func.toString() (https,fastly.com,443) https://a.com (https,a.com,443) (https,a.com,443)

  42. Scripts • Can load scripts from across origins • Scripts execute with privileges of the page • Page can see source via 
 func.toString() (https,fastly.com,443) https://a.com (https,a.com,443) (https,a.com,443) (https,evil.ch,443)

  43. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width https://a.com (https,a.com,443) (https,a.com,443)

  44. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width https://a.com (https,fb.com,443) (https,a.com,443) (https,a.com,443)

  45. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) then else https://a.com (https,fb.com,443) (https,a.com,443) (https,a.com,443)

  46. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) then else https://a.com (https,fb.com,443) (https,a.com,443) (https,a.com,443)

  47. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) 80px then else https://a.com (https,fb.com,443) 40px (https,a.com,443) (https,a.com,443)

  48. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) 80px then else https://a.com if (img.width > 40) { ... } 
 else { ... } (https,fb.com,443) 40px (https,a.com,443) (https,a.com,443)

  49. SOP for fonts and CSS are similar.

  50. SOP for cookies • Cookies allow server to store small piece of data on the client • Client sends cookie back to server next time the client loads a page • Sending cookies only to the right websites really important ➤ Don’t send cookie for bank.com to attacker.com if authentication token

  51. SOP for cookies • Cookies use a separate definition of origins. • DOM SOP: origin is a (scheme, domain, port) • Cookie SOP: ([scheme], domain, path) ➤ (https,cseweb.ucsd.edu, /classes/fa19/cse127-ab)

  52. SOP: Cookie scope setting • A page can set a cookie for its own domain or any parent domain, as long as the parent domain is not a public suffix. • The browser will make a cookie available to the given domain including any sub-domains Allowed Disallowed Subdomain login.site.com other.site.com Parent site.com com Other othersite.com

  53. SOP: Cookie scope setting • A page can set a cookie for its own domain or any parent domain, as long as the parent domain is not a public suffix. • The browser will make a cookie available to the cseweb.ucsd.edu can set cookies for ucsd.edu given domain including any sub-domains (unless ucsd.edu is on public suffix list) Allowed Disallowed Subdomain login.site.com other.site.com Parent site.com com Other othersite.com

  54. SOP: Cookie scope setting • A page can set a cookie for its own domain or any parent domain, as long as the parent domain is not a public suffix. • The browser will make a cookie available to the cseweb.ucsd.edu can set cookies for ucsd.edu given domain including any sub-domains (unless ucsd.edu is on public suffix list) Allowed Disallowed Subdomain login.site.com other.site.com Parent site.com com Other othersite.com

  55. // ===BEGIN ICANN DOMAINS=== // ac : https://en.wikipedia.org/wiki/.ac ac com.ac edu.ac gov.ac net.ac mil.ac org.ac // ad : https://en.wikipedia.org/wiki/.ad ad nom.ad // ae : https://en.wikipedia.org/wiki/.ae // see also: "Domain Name Eligibility Policy" at http://www.aeda.ae/eng/aepolicy.php ae co.ae net.ae org.ae sch.ae ac.ae gov.ae mil.ae // aero : see https://www.information.aero/index.php?id=66 aero accident-investigation.aero accident-prevention.aero aerobatic.aero aeroclub.aero aerodrome.aero agents.aero aircraft.aero airline.aero

  56. What cookies are sent? • Browser always sends all cookies in a URL’s scope: ➤ Cookie’s domain is domain suffix of URL’s domain ➤ Cookie’s path is a prefix of the URL path

  57. Cookie scoping example Cookie 1: Cookie 2: Cookie 3: name = mycookie name = cookie2 name = cookie3 value = mycookievalue value = mycookievalue value = mycookievalue domain = login.site.com domain = site.com domain = site.com path = / path = / path = /my/home Cookie 1 Cookie 2 Cookie 3

  58. Cookie scoping example Cookie 1: Cookie 2: Cookie 3: name = mycookie name = cookie2 name = cookie3 value = mycookievalue value = mycookievalue value = mycookievalue domain = login.site.com domain = site.com domain = site.com path = / path = / path = /my/home Cookie 1 Cookie 2 Cookie 3 checkout.site.com

  59. Cookie scoping example Cookie 1: Cookie 2: Cookie 3: name = mycookie name = cookie2 name = cookie3 value = mycookievalue value = mycookievalue value = mycookievalue domain = login.site.com domain = site.com domain = site.com path = / path = / path = /my/home Cookie 1 Cookie 2 Cookie 3 checkout.site.com No

  60. Cookie scoping example Cookie 1: Cookie 2: Cookie 3: name = mycookie name = cookie2 name = cookie3 value = mycookievalue value = mycookievalue value = mycookievalue domain = login.site.com domain = site.com domain = site.com path = / path = / path = /my/home Cookie 1 Cookie 2 Cookie 3 checkout.site.com No Yes

  61. Cookie scoping example Cookie 1: Cookie 2: Cookie 3: name = mycookie name = cookie2 name = cookie3 value = mycookievalue value = mycookievalue value = mycookievalue domain = login.site.com domain = site.com domain = site.com path = / path = / path = /my/home Cookie 1 Cookie 2 Cookie 3 checkout.site.com No Yes No

  62. Cookie scoping example Cookie 1: Cookie 2: Cookie 3: name = mycookie name = cookie2 name = cookie3 value = mycookievalue value = mycookievalue value = mycookievalue domain = login.site.com domain = site.com domain = site.com path = / path = / path = /my/home Cookie 1 Cookie 2 Cookie 3 checkout.site.com No Yes No login.site.com

Recommend

eDocument Security Awareness Model 2. eDocument Security Awareness Model THE EDOCUMENT SECURITY

eDocument Security Awareness Model 2. eDocument Security Awareness Model THE EDOCUMENT SECURITY

eDocument Security Awareness Model 2. eDocument Security Awareness Model THE EDOCUMENT SECURITY AWARENESS MODEL (ESAM) IS A SELF-ASSESSMENT TOOL GOAL OF THE EDOCUMENT SECURITY AWARENESS MODEL: Help governments with their secure document

579 views • 28 slides
Web Security: Basic Web Security Model [continued] Spring

Web Security: Basic Web Security Model [continued] Spring

CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Basic Web Security Model [continued] Spring 2015 Franziska (Franzi) Roesner

510 views • 18 slides
Model-based Security Security: ganzheitliche Engineering Eigenschaft: Jan Jrjens

Model-based Security Security: ganzheitliche Engineering Eigenschaft: Jan Jrjens

2 Herausforderung: Security Model-based Security Security: ganzheitliche Engineering Eigenschaft: Jan Jrjens Sicherheits-Mechanismen umgehen statt brechen. Sichere Systems aus Computing Department unsicheren Komponenten ? The

314 views • 6 slides
The Biba Model contd Security with respect to integrity in the Biba model is described by

The Biba Model contd Security with respect to integrity in the Biba model is described by

The Biba Model contd Security with respect to integrity in the Biba model is described by the following two axioms: Simple security property: Writing information to an object o by a subject s requires that SC(s) dominates SC(o) (no

690 views • 43 slides
The Network Network Security Secure against what/whom Security goals Attacker model Same

The Network Network Security Secure against what/whom Security goals Attacker model Same

The Network Network Security Secure against what/whom Security goals Attacker model Same hub `trusted LAN Internet Eavesdrop / block messages / insert messages / ... Typical attacker model security protocol analysis: Attacker

780 views • 63 slides
Widget security model based on MIDP and Web Application based on a security model with TLS/SSL

Widget security model based on MIDP and Web Application based on a security model with TLS/SSL

Widget security model based on MIDP and Web Application based on a security model with TLS/SSL and XMLDsig Claes Nilsson Technology Area Group Leader Web Browsing Marcus Liwell Technology Area Group Leader Security and DRM Rev 1

576 views • 12 slides
Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner

Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John

810 views • 24 slides
Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner

Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner,

570 views • 43 slides
Data Security in the Digital Age Reputation and Strategic Interactions in Security Investment

Data Security in the Digital Age Reputation and Strategic Interactions in Security Investment

Introduction Baseline Model Main Results Extended Model Lit. Review Conclusion Appendix Data Security in the Digital Age Reputation and Strategic Interactions in Security Investment Ying Lei Toh Toulouse School of Economics March 31, 2016

1.03k views • 37 slides
Web Security: Basic Web Security Model Spring 2016 Franziska (Franzi) Roesner

Web Security: Basic Web Security Model Spring 2016 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Basic Web Security Model Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John Manferdelli, John

498 views • 31 slides
Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go

Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go

Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go wrong on the web! Clients encounter malicious content Web servers are target of break-ins Fake content/servers trick users Data sent

446 views • 16 slides
Security CS 4720 Mobile Application Development CS 4720 The Traditional Security Model

Security CS 4720 Mobile Application Development CS 4720 The Traditional Security Model

Security CS 4720 Mobile Application Development CS 4720 The Traditional Security Model The Firewall Approach Keep the good guys in and the bad guys out CS 4720 2 Distributed System Security Islands of Security

883 views • 39 slides
A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome

A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome

A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome OS Speed Security - Verified boot Security - Reboot to recover Security for the internet age Current Operating Systems Chrome OS Apps have

424 views • 8 slides
Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The

Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The

Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The Open University, GB http://www.umlsec.org Challenge: Security Security is holistic property: Attackers often circumvent (not: break) mechanisms.

639 views • 36 slides
embedded security October 2015 The Old Model (simplified view) Embedded Security Benedikt

embedded security October 2015 The Old Model (simplified view) Embedded Security Benedikt

embedded security October 2015 The Old Model (simplified view) Embedded Security Benedikt Gierlichs KU Leuven, COSIC IACR Summer school 2015 Chia Laguna, Italy Attack on channel between communicating parties Encryption and

412 views • 6 slides
SAR-SSI 2012 1 Introduction Java Card security model Off-card security model Java class Byte

SAR-SSI 2012 1 Introduction Java Card security model Off-card security model Java class Byte

Samiya Hamadouche, Guillaume Bouffard , Jean-Louis Lanet, Bruno Dorsemaine , Bastien Nouhant, Alexandre Magloire, Arnaud Reygnaud guillaume.bouffard@xlim.fr bruno.dorsemaine@etu.unilim.fr SAR-SSI 2012 1 Introduction Java Card security model

227 views • 19 slides
CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up malicious site visited by victim; no control of network Alice Network Security Network Attacker Intercepts and controls network communication

907 views • 44 slides
SECTET SECTET Model driven Security of Service Oriented Systems y y based on Security as

SECTET SECTET Model driven Security of Service Oriented Systems y y based on Security as

Japan-Austria Joint Workshop on ICT October 18-19 2010, Tokyo, Japan SECTET SECTET Model driven Security of Service Oriented Systems y y based on Security as a Service Basel Katt , Ruth Breu, Mukhtiar Memon and Michael

646 views • 26 slides
How to capture, model, and verify the knowledge of legal, security, and privacy experts: a

How to capture, model, and verify the knowledge of legal, security, and privacy experts: a

Universit degli Studi di Trento How to capture, model, and verify the knowledge of legal, security, and privacy experts: a pattern-based approach L. Compagna, P. El Khoury F. Massacci , N. Zannone R. Thomas Security Research Dept.

357 views • 14 slides
Security models part 2 Bj orn Victor Fall 2007 Doris Denning model Denning model Chinese

Security models part 2 Bj orn Victor Fall 2007 Doris Denning model Denning model Chinese

Security models part 2 Bj orn Victor Fall 2007 Doris Denning model Denning model Chinese Wall Clark-Wilson Principles BLP: covert channels possible -property too strong Improvement: analyse actual (and indirect) information flow.

676 views • 45 slides
Model-Based Security M. Ochoa Verification and Testing for F. Bouquet Smart-Cards J. Bottela

Model-Based Security M. Ochoa Verification and Testing for F. Bouquet Smart-Cards J. Bottela

Model-Based Security M. Ochoa Verification and Testing for F. Bouquet Smart-Cards J. Bottela E.Fourneret J.Jurjens P. Yousefi ARES 2011 OUTLINE Introduction Background UMLsec Model-based Testing Security in smart-card

356 views • 17 slides
CSCI-UA.9480 Introduction to Computer Security Session 4.1 Browser Security Model Prof. Nadim

CSCI-UA.9480 Introduction to Computer Security Session 4.1 Browser Security Model Prof. Nadim

CSCI-UA.9480 Introduction to Computer Security Session 4.1 Browser Security Model Prof. Nadim Kobeissi Defining 4.1a Browser Security Goals Also before we start: Practical Assignment 2 is now online . 2 CSCI-UA.9480: Introduction to

520 views • 28 slides
Institute for Cyber Security A Formal Model for Isolation Management in Cloud

Institute for Cyber Security A Formal Model for Isolation Management in Cloud

Institute for Cyber Security A Formal Model for Isolation Management in Cloud Infrastructure-as-a-Service Khalid Zaman Bijon, Ram Krishnan and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio October 15-17, 2014 NSS

146 views • 13 slides
Security, IAM AWS sh shared red res espon ponsib sibility ility mo model el Portland

Security, IAM AWS sh shared red res espon ponsib sibility ility mo model el Portland

Security, IAM AWS sh shared red res espon ponsib sibility ility mo model el Portland State University CS 430P/530 Internet, Web &amp; Cloud Systems Cloud ud se security urity In this course, security &quot;in-the-cloud&quot; via

445 views • 28 slides

More recommend