Advanced Ajax Security

Loading...

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

0 comments

Post a comment

    Post a comment
    Embed Video
    Edit your comment Cancel

    4 Favorites

    Advanced Ajax Security - Presentation Transcript

    1. Advanced Ajax Security Billy Hoffman ( [email_address] ) Manager, HP Security Labs
    2. Who am I?
      • Manager HP Security Labs
      • In security space for 6 years
      • CS Degree from Georgia Tech
      • Areas of focus
        • Crawling and sampling
        • JavaScript static analysis
        • XSS
      • Frequent presenter at hacker/security conferences
    3. Presentation Overview
      • Manipulating Client-side logic
      • Defeating logic protection techniques
      • Function Hijacking
      • JSON Hijacking
      • Hacking Google Gears
      June 2, 2009
    4. “ Boring” Ajax Security
      • Increased attack surface
      • Direct API access
      • Easier to reverse engineer
      • Amplifying web attacks
      • Offline attacks
      • “ Surely no one actually does this right?”
      June 2, 2009
      • Sample Ajax travel website
      • Built using “expert” advice
        • Popular books
        • Articles/How-tos
        • Forums
      • Riddled with security defects
      Sexy Ajax Security June 2, 2009
    5. API Domino Effect June 2, 2009 holdSeat(flightID) makeOffer(price, flightID) debitAccount(price) bookSeat(flightID)
    6. Overly Granular Application API June 2, 2009 Insecure More secure
    7. Polling Status Call June 2, 2009
    8. Real-world Example June 2, 2009
    9. Web 1.0 to Web 2.0 Conversion June 2, 2009
    10. Premature Ajax-ulation! June 2, 2009
    11. Exposed Administrative API June 2, 2009 Malicious use Intended use
    12. Defeating Logic Protection
      • Obfuscation
      • Lazy Loading
      June 2, 2009
    13. All Your Obfuscation Are Belong To Us!
      • How to debug code if you don’t have it all?
      • Firebug cannot debug dynamic code
        • JSON responses
        • Remote scripting
        • Lazy loading
      • “ View Source” vs “View Generated Source”
      • Need a way to monitor JavaScript environment
      On-Demand JavaScript
    14. Understanding JavaScript Variable Scope
      • Everything is a object
        • Primitives (Strings, numbers, regexp)
        • Functions
      • All global variables and functions are properties of global object
      • Provided by environment
      • Web browser = window
      • Can we enumerate?
    15. Example Code
      • function BogusFunction1() {
      • //empty function
      • }
      • function BogusFunction2() {
      • //empty function
      • }
      • var ret = "";
      • for(var i in window) {
      • if(typeof(window[i]) == "function") {
      • ret += i + " ";
      • }
      • }
      • alert(ret);
    16. Enumerating All Functions
    17. HOOK: JavaScript Monitoring Framework
      • Enumerates the environment and traps on-demand code.
      • Side-steps obfuscation
      • Reads from the environment itself
      • Demo
    18. Take Aways: Client-side Code
      • Client-side code is just a suggestion!
      • Client-side code cannot be protected, encrypted, or obfuscated
      • Store all secrets on the server
      • Enforce control flow on the server
      • Always match allocations with frees in the same method
      • Use Server-side locking to prevent race condition vulnerabilities
      June 2, 2009
    19. JavaScript Function Clobbering
      • Highly dynamics language
      • Typeless, dynamic execution paths
      • Can redefine itself at runtime
      June 2, 2009
    20. JavaScript Namespaces
      • Namespaces prevent collisions
      • Solution: Make functions properties of objects
      • var com.SomeSite.common = {};
      • com.SomeSite.common.debug
      • = function () { … };
      • com.SomeSite.common.debug();
      • var com.SexyWidgets = {};
      • com.SexyWidgets.debug = function() {…};
      • com.SexyWidgets.debug();
    21. JavaScript Namespaces
    22. Intentional Function Clobbering
      • Attacker deliberately clobbers functions
      • What kind of functions can you clobber?
        • User defined functions?
        • System functions?
      • Demo
    23. Clobbering System Functions: alert()
    24. Prototype’s Ajax.Request()
      • Can clobber anything
      • Automatic Man In The Middle
      • Other things
        • Dojo.Storage
        • Callback functions
        • Encryption functions?
      Limitless Clobbering Possibilities
    25. The Myth of the Same Origin Policy
      • Myth: Same Origin Restricts prevent JavaScript from seeing 3 rd party content
      • Fact: Kind of prevents
        • Remote Scripting
        • Image and Iframe events (JavaScript port scanning)
        • 3 rd party plug-in communications
    26. JSON Hijacking
      • JSON is a valid subset of JavaScript
      • eval() can be used to “see” the response
      • Could use remoting scripting to read JSON web services?
      June 2, 2009
    27. JSON Hijacking
      • <script type=&quot;text/javascript&quot;>
      • [[&quot;AJAXWorld&quot;, &quot;2007-04-15&quot;, &quot;2007-04-19&quot;, [&quot;ATL&quot;, &quot;JFK&quot;, &quot;ATL&quot;],
      • 95120657, true],
      • [&quot;Honeymoon&quot;, &quot;2007-04-30&quot;, &quot;2007-05-13&quot;, [&quot;ATL&quot;, &quot;VAN&quot;, &quot;SEA&quot;, &quot;ATL&quot;],
      • 19200435, false],
      • [&quot;MS Trip&quot;, &quot;2007-07-01&quot;, &quot;2007-07-04&quot;, [&quot;ATL&quot;, &quot;SEA&quot;, &quot;ATL&quot;],
      • 74905862, true],
      • [&quot;Black Hat USA&quot;, &quot;2007-07-29&quot; &quot;2007-08-03&quot;, [&quot;ATL&quot;, &quot;LAS&quot;, &quot;ATL&quot;],
      • 90398623, true]];
      • </script>
    28. JSON Hijacking
      • How does JS interpreter handle literals?
      • [9,4,3,1,33,7,2].sort();
      • Creates temporary Array object
      • Executed sort() function
      • Never assigned to variable
      • Garbage collected away
    29. JSON Hijacking
      • How does JS interpreter handle literals?
      • [9,4,3,1,33,7,2].sort();
      • Creates temporary Array object
        • Invokes Array() constructor function
      • Executed sort() function
      • Never assigned to variable
      • Garbage collected away
    30. JSON Hijacking
      • Clobber the Array() function with malicious version
      • Use <SCRIPT SRC> to point to JSON web service
      • Malicious Array() function harvests the data that comes back!
      • function Array() {
      • var foo = this;
      • var bar = function() {
      • var ret = &quot;Captured array items are: [&quot;;
      • for(var x in foo) {
      • ret += foo[x] + &quot;, &quot;;
      • }
      • ret += &quot;]&quot;;
      • //notify an attacker here
        • };
      • setTimeout(bar, 100);
      • }
    31. JSON Hijacking Example
    32. JSON Hijacking Example
    33. JSON Hijacking Defense
      • XMLHttpRequest can see the response and perform operations on it before eval() ing
      • <SCRIPT SRC> cannot!
      • Make the JSON response non-valid JavaScript
      • XHR removes it!
      • <SCRIPT SRC> fails!
    34. Bad Approach #1
      • <script type=&quot;text/javascript&quot;>
      • I'// a bl0ck of inva1id $ynT4x! WHOO!
      • [[&quot;AJAXWorld&quot;, &quot;2007-04-15&quot;, &quot;2007-04-19&quot;, [&quot;ATL&quot;, &quot;JFK&quot;, &quot;ATL&quot;],
      • 95120657, true],
      • [&quot;Honeymoon&quot;, &quot;2007-04-30&quot;, &quot;2007-05-13&quot;, [&quot;ATL&quot;, &quot;VAN&quot;, &quot;SEA&quot;, &quot;ATL&quot;],
      • 19200435, false],
      • [&quot;MS Trip&quot;, &quot;2007-07-01&quot;, &quot;2007-07-04&quot;, [&quot;ATL&quot;, &quot;SEA&quot;, &quot;ATL&quot;],
      • 74905862, true],
      • [&quot;Black Hat USA&quot;, &quot;2007-07-29&quot; &quot;2007-08-03&quot;, [&quot;ATL&quot;, &quot;LAS&quot;, &quot;ATL&quot;],
      • 90398623, true]];
      • </script>
      • <script type=&quot;text/javascript&quot;>
      • /*
      • [&quot;Eve&quot;, &quot;Jill&quot;, &quot;Mary&quot;, &quot;Jen&quot;, &quot;Ashley&quot;, &quot;Nidhi&quot;]
      • */
      • </script>
      Bad Approch #2
    35. Bad Approach #2
      • <script type=&quot;text/javascript&quot;>
      • /*
      • [&quot; Eve*/[&quot;bogus &quot;, &quot;Jill&quot;, &quot;Mary&quot;, &quot;Jen&quot;, &quot;Ashley&quot;, &quot; bogus&quot;]/*Nidhi &quot;]
      • */
      • </script>
      • <script type=&quot;text/javascript&quot;>
      • /*
      • [&quot;Eve*/ [&quot;bogus&quot;, &quot;Jill&quot;, &quot;Mary&quot;, &quot;Jen&quot;, &quot;Ashley&quot;, &quot;bogus&quot;] /*Nidhi&quot;]
      • */
      • </script>
    36. Correct Approach
      • <script type=&quot;text/javascript&quot;>
      • for(;;);
      • [&quot;Eve&quot;, &quot;Jill&quot;, &quot;Mary&quot;, &quot;Jen&quot;, &quot;Ashley&quot;, &quot;Nidhi&quot;]
      • </script>
    37. Correct Approach
      • function defangJSON(json) {
      • if(json.substring(0,8) == &quot;for(;;);&quot;) {
      • json = json.substring(8);
      • }
      • Return json;
      • }
      • var safeJSONString = defangJSON(xhr.responseText);
      • var jsonObject = safeJSONString.parseJSON();
    38. Securing Ajax Applications
      • Perform authentication/authorization checks on both web pages and web services
      • Group code libraries by function
      • Validate all input for your application
        • HTTP headers, cookies, query string, POST data
      • Verify data type, length and format
      • Always use parameterized queries
      • Always encoded output appropriately
      June 2, 2009
    39. Salvation Is Here!
      • Ajax Security Addison-Wesley
      • &quot; Ajax Security is a remarkably rigorous and thorough examination of an underexplored subject. Every Ajax engineer needs to have the knowledge contained in this book - or be able to explain why they don't.”
      • -Jesse James Garret
      • In stores now!
      June 2, 2009
    40. Advanced Ajax Security Billy Hoffman ( [email_address] ) Manager, HP Security Labs

    + amiable_indianamiable_indian, 2 years ago

    custom

    1673 views, 4 favs, 3 embeds more stats

    Advanced Ajax Security

    More info about this document

    © All Rights Reserved

    Go to text version

    • Total Views 1673
      • 1628 on SlideShare
      • 45 from embeds
    • Comments 0
    • Favorites 4
    • Downloads 49
    Most viewed embeds
    • 23 views on http://www.secguru.com
    • 21 views on http://www.vigilia.org
    • 1 views on http://www.blogger.com

    more

    All embeds
    • 23 views on http://www.secguru.com
    • 21 views on http://www.vigilia.org
    • 1 views on http://www.blogger.com

    less

    Flagged as inappropriate Flag as inappropriate
    Flag as inappropriate

    Select your reason for flagging this presentation as inappropriate. If needed, use the feedback form to let us know more details.

    Cancel
    File a copyright complaint
    Having problems? Go to our helpdesk?

    Categories