Building And Stopping Next Generation Xss Worms

building and stopping next generation xss worms arshan dabirsiaghi director of research aspect security

who am i? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

talk agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

1 st : is an xss worm really a worm? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

how xss worms are different from traditional ,[object Object],[object Object],[object Object],[object Object]

what about an xss virus? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

infection model ,[object Object],[object Object],[object Object],[object Object],innocent girl on myspace myspace.com WORM NODE n / 2,872,341 profiles are worm nodes n+1 / 2,872,341 profiles are worm nodes

how xss worms are different from traditional ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

target shift IIS 6.0 IIS 6.0 IIS 6.0 IIS 6.0 www.myspace.com www.facebook.com www.linkedin.com peoplesoft.internal

penetration CSRF 3 rd Party Proxy www.facebook.com peoplesoft.internal www.myspace.com

traits of current xss worms ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

current incident response options ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

next gen xss worm RECONNAISSANCE (1 of 5) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

cross-site communication in HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object]

(gulp) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

staniford, paxson & weaver’s RECONNAISANCE techniques ,[object Object],[object Object],[object Object],[object Object]

next gen xss worm ATTACK (2 of 5) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

polymorphic javascript ,[object Object],[object Object],Before Mutation After Mutation Mutation Effects doEvil1() zDx/*fdSa*/() symbol renaming, random comment introduction xhr.open(“GET”,url,true); xhr.open(“G”+”ET”,url, true); string fragmentation, whitespace randomization countless encodings, block re-structuring, JIT eval compilation

next gen xss worm COMMUNICATION (3 of 5) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

next gen xss worm COMMAND (4 of 5) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

MyFaceNovel.com  Attacker quietly posts signed payloads  Victim creates token www.evil.com Google (JSON) www.geocities.com/evil1 www.myspace.com/evil2 www.sharedhost.net/evil3 www.goodguys.com/poison remote scripting  Victim queries Google for token using JSON  Victim finds a signed result  Executes the signed payload

wait… signing in javascript? ,[object Object],[object Object],[object Object]

next gen xss worm INTELLIGENCE (5 of 5) ,[object Object],[object Object],[object Object],[object Object],[object Object]

search+destroying polymorphed javascript ,[object Object]

on demand exploit egress filters ,[object Object],doSomethingEvil(); xhr.onreadystatechange=handleIt; xhr.open(“GET”,url,true); xhr.send(null); doSomethingEvil(); xhr.onreadystatechange=handleIt; //xhr.open(“GET”,url,true); xhr.send(null);

OWASP AntiSamy – safe rich input validation ,[object Object],[object Object],[object Object],(samy) ,[object Object]

utilizing cross-domain workflows ,[object Object],[object Object]

browser content restrictions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Book Reviews ThiefBook Thief1 Thief2 Buy Find Policy -------- -------- -------- -------- -------- Ads ,[object Object],[object Object],[object Object],[object Object]

Building And Stopping Next Generation Xss Worms

Recommended

Recommended

More Related Content

Recently uploaded

Recently uploaded (20)

Featured

Featured (20)

Building And Stopping Next Generation Xss Worms