Downloaded 15 times
Uploaded byCyber Security Alliance
Warning Ahead: SecurityStorms are Brewing in Your JavaScript
The document discusses security vulnerabilities in JavaScript, particularly focusing on the implications of HTML5 features like sandboxing and the risks associated with cross-site scripting (XSS). It details specific attack methods, such as 'monster XSS,' that exploit these vulnerabilities to capture user data, and emphasizes the importance of securing client-side applications. Recommendations provided include avoiding unnecessary permissions in iframes and maintaining vigilance against XSS attacks.
Warning Ahead: SecurityStorms are Brewing in Your JavaScript
- 1. Warning Ahead: SecurityStorms are Brewing in Your JavaScript
- 2. About Me HelenBravo Product Manager of Checkmarx Static Application Security Testing (AKA – Source Code Analysis)
- 3. Agenda • Brokensandbox • Same old XSS becomes a monster • Watch out for your client side • “I know where you were last summer”
- 4. HTML5 is booming Report released in August 2013 has shown that 153 of the Fortune 500 U.S. companies already implemented HTML5 on their corporate websites.
- 5. Some of theadditions in HTML5 • WEB storage • WEB SQL database • Indexed DB • Application cache • Web workers • Web socket • CORS • Web messaging • Sandbox attribute • New HTTP headers • Server sent events • New and better semantic tags • New form types • Audio and video tags • Canvas • Inline SVG • New onevent attributes • Geolocation • New CSS selectors • New javascipt selectors • Custom data - attributes
- 6.
- 7. SOP Same OriginPolicy permits scripts running on pages originating from the same site based on combination of scheme, hostname, and port number
- 8. Same Origin Policy http://www.cnn.com/main main page “Change background to green” http://www.cnn.com/story1 Iframe same origin
- 9. Same Origin Policy http://www.cnn.com/main main page “Change background to green” http://www.fox.com Iframe different origin
- 10. Markets • Recenttrend - markets of extensions Salesforce.com, Microsoft 365, etc… • Extension is Javascript code written by a 3rd party but hosted and delivered from the very same server • So SOP doesn’t play well
- 11. Sandbox concept Sandboxconcept? Sandbox is a hardening of the basic SOP – so that any content running in the sandboxed iframe is treated as if it comes from a different origin, and it gives fine-grained control over what restrictions apply.
- 12. Sandbox syntax •Syntax <iframe sandbox="value"> Valu•e Attribute Values Description "" Applies all restrictions below allow-same-origin Allows the iframe content to be treated as being from the same origin as the containing document allow-top-navigation Allows the iframe content to navigate (load) content from the containing document allow-forms Allows form submission allow-scripts Allows script execution
- 13. http://www.server.com http://www.server.com/iframe mainpage <script> alert(1) </script> 1 Iframe / same origin
- 14. http://www.server.com http://www.server.com/iframe mainpage <script> alert(1) </script> Sandboxed Iframe Default permissions Same Origin
- 15. http://www.server.com http://www.server.com/iframe mainpage <script> alert(1) </script> 1 Sandboxed Iframe Allowing Scripts and SOP(Same Origin)
- 16. http://www.server.com http://www.server.com/iframe mainpage <script> top.navigate(…) </script> Sandboxed Iframe Allowing Scripts and SOP(Same Origin)
- 17. http://www.server.com http://www.server.com/iframe mainpage <script> top.find(myself) addPermission(myself, top_nav) Refresh() navigate(…) </script> Sandboxed Iframe Allowing Scripts and SOP(Same Origin) And Top Navigation
- 18. http://www.hacker.server.com http://www.server.com/iframe mainpage <script> top.find(myself) addPermission(myself, top_nav) Refresh() Navigate(http://www.hacker.com) </script> Sandboxed Iframe Allowing Scripts and SOP(Same Origin) And Top Navigation
- 19. Don’t just counton Sandbox! Don’t assume that just because an iFrame is sandboxed, your code is secure. What can you do? Avoid granting a sandboxed iFrame with scripting and SOP capabilities.
- 20. How a singleXSSed page can be used to take screenshots of other non-XSSed page ?
- 21. <canvas> Is theHTML5 element , used to draw graphics, on the fly, via scripting (usually JavaScript).
- 22. Monster XSS –Attack Steps • Step A – Use Bookstore project Login page vulnerable to Reflected XSS to embed itself in an iframe http://server/page.aspx?xss=<iframe src=“http://server/page.aspx”> Iframe border (left visible for demo purposes)
- 23. Monster XSS –Attack steps • Step B – The user logs in and browses the inside frame. The outer page remains the same while it’s scripts can access the inner’s data Iframe border (left visible for demo purposes) The user went to the admin page, but the URL is still the XSS’ed login page
- 24. Monster XSS –The result • The attacker gets set of pictures representing all user activity( yes, including user name and password!)
- 25. Monster XSS –The technique • HTML5 introduced the concept of Canvas, which can be used to take screenshots What is Canvas? (w3schools) The HTML5 <canvas> element is used to draw graphics, on the fly, via scripting (usually JavaScript).
- 26. Monster XSS –The technique • Html2canvas - open-source script which builds screenshots based on DOM information. • We modify it a bit – to reveal passwords
- 27. Monster XSS –The technique Modified HTML2Canvas runs at the outer page and every 2 seconds takes screenshots of the iframe XSS that takes base64 screenshots
- 28. Monster XSS –The technique
- 29. Monster XSS –bottom line So, what can you do ? Get rid of XSS!!!
- 30.
- 31. Web Socket WebSocket– allows persistent connection between the client and the server , when both parties can start sending data at any time.
- 32.
- 33. New Tricks, OldDog • XSS can be used as an agent to map the structure of a network behind a firewall • Super-charged XSS – Advanced port scanning (WebSockets) • http://www.andlabs.org/tools/jsrecon.html
- 34. • Websocket –Fast and efficient network mapping process – Firewall bypass into organization
- 35.
- 36. Pacman - winningthe odds • Client site business logic helps to gain efficiency. • Efficiency brings along security costs
- 37.
- 38. Pacman – recommendations • Don’t trust the client: validate user input • Do not ever store business logic on the client
- 39.
- 40. A Variant ofClickjacking How to trick victims into turning on their PC cameras without them even realizing?
- 41. A Variant ofClickjaking Demo http://localhost/bookstore/k2.html
- 42. A Variant ofClickjaking Against attacks focused on social engineering There is only one solution Awareness
- 43. Summary • HTML5brings enhancements to Web development • …which comes with some great enhancements to security vulnerabilities
- 44. Thank you! HelenBravo helen.bravo@checkmarx.com
Editor's Notes
- #3 Since we have visibility to a lot of customers data, and a lot of problems in JavaScript. And I am here to share it with you.
- #4 exacerbate
- #6 Explain each attribute concept
- #11 Additional reason for sand box invention
- #13 Let’s take a look at the granularity and what types of activities sandbox enables. Let’s look at the values, what it allows us. Even if you know it well let’s review it for the quize you are going to have at the end.
- #19 Fix animation Punchline: And with that we have defeded the whole concept of sandbox
- #27 s