web security
play

Web Security Erik Poll Digital Security group Radboud University - PowerPoint PPT Presentation

Sep 16, 2023 •494 likes •1.11k views

Web Security Erik Poll Digital Security group Radboud University Nijmegen websec 1 This course The web is a endless source of security problems. Why? The web is very widely used, so its interesting to attack The web is very complex

  1. Web Security Erik Poll Digital Security group Radboud University Nijmegen websec 1

  2. This course The web is a endless source of security problems. Why? The web is very widely used, so it’s interesting to attack • The web is very complex and rapidly evolving • so there are many & often new possibilities for attacks Goals of this course: How do attacks on the web work? • What we can do about them? • Why are these attacks possible? • websec 2

  3. Wider context Most security problems arise from attacks on 1. people 2. software 3. interaction & misunderstandings between people & software Common attacks on software are attacks exploiting memory corruption (treated in Hacking in C) • attacks on web technology (this course) • websec 3

  4. Organisation Weekly lecture • read the slides & any reading material mentioned try out the demo webpages mentioned in the lecture • ask questions in Discord channel for the lecture • Weekly lab session with 3 types of exercises 1. lessons on OWASP WebGoat • no need to hand these in 2. challenges at http://websecurity.cs.ru.nl handed in automatically when you complete them • NB for this you will need your Science login 3. ad-hoc assignments to be handed in via Brightspace • Help with lab sessions on Wednesdays 12:30-15:15 via Discord Work in pairs • Doing the exercises is obligatory to take part in the exam • Cheating is trivial, but exam questions will assume familiarity with the exercises websec 4

  5. Course materials All info & course material is in Brightspace Obligatory reading all the slides • some articles & blog posts linked to in Brightspace • • ‘Surviving the Web: A Journey into Web Session Security’ Stefano Calzavara et al. (ACM Computing Surveys, Vol. 50 No 1, 2017) Optional background reading: Introduction to Computer Security by Michael Goodrich and Roberto Tamassia Chapters 1, 5.1, 7 There is a copy in the studielandschap in the library websec 5

  6. Any questions on organisational matters?

  7. Audience poll (1) Have you ever built a web site, or an app that uses web technologies? (eg. HTTP, HTML, XML, JSON)

  8. Audience poll (2) Have you ever tried to hack a web site?

  9. Audience poll (3) Have you ever participated in a CTF? If you like the practical side of this course, join our student CTF team at ctf-ru.slack.com

  10. Today: What is the web? Evolution of the web • • Core technologies – HTTP – URL – HTML which includes JavaScript & the DOM Encodings for representing data • – base64 encoding, URL encoding, HTML encoding websec 10

  11. The internet & the web websec 11

  12. The internet & The web Often confused, but they are different • The internet – provides networking between computers – using the IP protocol family with UDP or TCP • The web – collection of services that can run over the internet – using the HTTP/HTML protocol family web internet websec 12

  13. The internet & The web Protocol stack of many languages and protocols • Various services can be provided over the internet: • email (SMTP), VoIP, ftp, telnet, ssh, ... and HTTP HTML ... ... HTTP TP Application Layer SMTP DNS VoIP TCP UDP Transport Layer Network Layer IP v4 or v6 Link Layer Ethernet, WiFi, Physical layer 4G/5G, … websec 13

  14. The world wide web The web is one of the services available over the internet www = HTTP + HTML + URLs At the server side, it involves a web server that typically – listens to port 80 – accepts HTTP requests (eg GET or POST request), processes these, and then returns HTTP response At the client side, it involves a web browser websec 14

  15. Aside: Protocols For example : IP, HTTP, HTTPS, DNS, TLS, SMTP, … Procotol is set of rules for two (or more) parties to interact • Not just between computers. People also follow protocols: when they meet, when they answer the phone, when they buy a coffee ,… Protocols usually specify two aspects of interaction: 1. language / data format for messages e.g. specified by regular expression or grammar • 2. correct / expected sequences of messages e.g. specified by finite automaton aka state machine • or a Message Sequence Chart (MSC) websec 15

  16. Aside: Languages (or formats) For example file formats: .html, .docx, .pdf, .txt, .mp3, .jpeg, .mp4, .js , … • • other pieces of data: URLs, domain names, email addresses, IP packets, HTTP responses & requests, … The definition of a language or data format involves • syntax – what are correct words/sentences/sequences of bytes? semantics • – what do these mean? ie. how should they be interpreted? Complexity and ambiguity in languages are major root causes of security problems websec 16

  17. Ev Evolution lution of th the e web websec 17

  18. Evolution of the web Web is constantly evolving more functionality, more flexibility, nicer GUIs, …  • more complexity, more or new security problems  • 1. Static hypertext 2. Dynamically generated web pages Web 2.0 • 3. Dynamic web pages aka web apps • 4. Ajax: asynchronous interaction between browser & server 5. More Web APIs 6. Apps on mobile phones & tablets websec 18

  19. 1. Static hypertext For example, http://www.cs.ru.nl/~erikpoll/websec/index.html websec 19

  20. 1. Static hypertext Originally, the web consisted of static HTML: hypertext with links and pictures Content of such a webpage can simply be a fixed file on the file • system, so a (very simple) web server only has to retrieve files from disk The content doesn’t depend on user input & is not • personalised: all users see the same page. No user interaction, apart from the user clicking on links to • load another page Eg http://www.cs.ru.nl/~erikpoll/websec/index.html websec 20

  21. Synchronous interaction on the web web web server browser 1. user types in URL 2. HTTP request 3. server retrieves webpage 4. HTTP response 5. browser renders new webpage 6. user clicks on link user HTTP request HTTP response This is overly simplistic. Even very simple browsing is much more asynchronous. E.g. browser will start rendering while images are retrieved. websec 21

  22. 2. Dynamically created web pages websec 22

  23. 2. Dynamically created web pages execution to compute a webpage web browser complex web server Dynamically computed data HTTP response base Interaction still synchronous In general, having execution is nice, as it is flexible & powerful but this also makes it dangerous websec 23

  24. 2. Dynamically created web pages Web page is dynamically created, on demand Eg google, gmail, facebook, brightspace, amazon, ... Different users will be served a different webpage The web server now runs a web application The web applications run in a web application server • – eg Apache Tomcat, Websphere ,… • The applications are written in scripting or programming languages – eg CGI, Perl, Python, PHP, Java, C#, Ruby on Rails, Go, … This allowed web 2.0, with user-generated content in web forums , Wikipedia, and social media: facebook, Instagram, twitter,... websec 24

  25. 3. Dynamic web pages execution of JavaScript web server web browser HTTP response containing JavaScript code Eg. http://www.cs.ru.nl/~erikpoll/websec/demo/demo_javascript.html websec 25

  26. 3. Dynamic web pages Web pages include code that is executed in the browser • Two main languages for this: • • JavaScript • part of the HTML5 standard WebAssembly (Wasm) • since 2017 • Older languages used for dynamic behavior in the browser included • Java, ActiveX, Flash, Silverlight, … • Goals: more attractive web pages • more and faster interaction with the users • • there can be interaction between the user & browser, and changes to the webpage, without a new page being loaded websec 26

  27. Evolution in web technologies Technologies used by top 500 web sites [Source: Stock et al, How the Web Tangled Itself: Uncovering the History of Client- Side Web (In)Security, USENIX Security Symposium, 2017] websec 27

  28. 4. asynchronous interaction with Ajax websec 28

  29. asynchronous interaction with Ajax execution web web server browser XMLHttpRequests , and responses containing eg XML or JSON data With Ajax the initiative for interaction still lies with the browser; With WebSockets communication becomes full duplex ie. web server can take initiative to send message websec 29

  30. 4. Ajax = Asyncronous JavaScript with XML JavaScript in browser asynchronously interacts with the server, using a XMLHttpRequest object Classic example: word completion in Google search bar as you type Typical characteristics 1. interaction independent of the user clinking on links 2. without reloading whole webpage: code can update part of webpage Originally, the data exchanged was in XML format, nowadays JSON is more commonly used. websec 30

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM & UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides
Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Material and some slide content from: - Software Architecture: Foundations, Theory, and Practice - Krzysztof Czarnecki Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security: The protection a ff orded a

160 views • 4 slides
Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

1.36k views • 113 slides
Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security policies Computer Security Basic concepts Peter Reiher Security policies for real systems January 13, 2005 Lecture 2 Lecture 2 Page 1

347 views • 9 slides
Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security risks. Attacks in a cloud environment, top threats. Security, a major concern for cloud users. Privacy. Trust. Operating systems

661 views • 38 slides
Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election Security = Physical Security + Cybersecurity Physical Security Security plans Secure storage of voting machines and electronic pollbooks

341 views • 13 slides
Computer Security environment, without compromising functionality or security? Three parts

Computer Security environment, without compromising functionality or security? Three parts

9/7/2013 Some topics Im working on Computing on encrypted data Information flow: Dynamic IFC in Haskell, web Sandboxing Untrusted JavaScript Third party web tracking and other web security stories Practical web security

572 views • 21 slides
Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon Transport Network Link Physical CSE 461 University of Washington 2 Security Threats Security is like performance Means many things

1.12k views • 92 slides

More recommend