The Security Risks of Web 2.0 - DEF CON 17

1,851 views

Published on

The security risks of Web 2.0 by David Rook at DEF CON 17 2009.

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
1,851
On SlideShare
0
From Embeds
0
Number of Embeds
368
Actions
Shares
0
Downloads
20
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

The Security Risks of Web 2.0 - DEF CON 17

  1. 1. !" # $
  2. 2. ! "
  3. 3. ! #$ %& # &# # ( ! ) * + * , - " + " ,. & " - " /( "0 " + / 1 # / ,
  4. 4. " 23% & & & $ (3 !& ) & ) & 3* & + & ," -&. & " 43 % // & 30 ) 1 & 2 330 ) / & 3
  5. 5. 5 " " # "" / 46 "" / " " 7 .2$ 8 9
  6. 6. $ % & %(" # !"#$ %
  7. 7. % ) & %*( ( + & %*( & %(0 : $ / / & 6 / " ; / 6< / ! =># ! &# ! & ? @# ? .)# . &# $< # @=># ! &# ! & 8 & & " - # " " & &
  8. 8. + & %(, % " / $ 0 / A> * 0 > / /
  9. 9. & %( , %. " " 43@30 *3= " / !
  10. 10. + - ) B) BC@ "" "" / /
  11. 11. + -) 8& 5$ 7 " " / 4D "E + ,D: "E& 5 7 " + / , " / 4D "E FG "4:: % " : /8 : / BGH D: "E-.= 6 " / -.=# 4 "4:: % " : " "B FD " EIII " 4D "E" F ;$> %. +J FJ,HKL + ;$> /+" # ;$> / ,,L D: "E
  12. 12. + - B- -.= ""; " " " / /@ + ? .)# @=> ,
  13. 13. + -- -.= ? @ $ "" * " -.= + , / 4D "E + ,D: "E * -.== " ? .)-.= * " +,
  14. 14. + - +, M "L + @=>! "$ ,M "F @=>! "$ +,L N + @. * , M "F @. * +J= % @=>! &J,L +O ", M "F @. * +J= @=>! &J,L NN " " +J(< J# 7 " % " "B F "4:: 8 % " J# ,L " / F +, M + " FF P, M " F " " % L :: + ,N N " + ,L N
  15. 15. + . / + / ) B) BC $0 // 8 2 " 8 "" # 2"@ OF $0@ # " % 2 # $0# % /
  16. 16. + . / + / &. "4:: * : / ! &: ! & F * Q" F) * Q F
  17. 17. + . / + /(< "4:: * :" B * F/ * Q F ! &:! & -F RPK9STU
  18. 18. + . / + /D=( $ F5 "4:: * :" B * F * 7 :E! &:! & -F RPK9STU
  19. 19. + . / + / B@=> ? .) " . / & G "
  20. 20. + . / + / (= > / " $0 - V / - 1 D=( $ I D0$ =< $ I %"D / FJ " 4:: / / : :;" & F Q F Q/ " F. & Q. & F& .$- Q&F RQ& / F RQ"FQ F JED FJ " 4:: / / : :;" & F Q F Q/ " F. & Q. & F& .$- Q&F RQ& / F RQ"FQ F JE
  21. 21. + . / + /( / $0 ? .)) @=>! "$ +@!$, "? .) 2 / B? .) O
  22. 22. + . / + /( / $0 ? .)D " " FJ % :* " JE / / + ,M # L + F L D 6 / L HH, M HF JD EJ H 6 WX< H JD: EJL N +JD EJ H H JD: EJ,LND: "ED " " FJ % :* "J FJ "4:: / / : : B F* Q F >>Q" F Q F/ / Q %FUUUUUJED: "E !
  23. 23. 01 2 ) B) BC A> *J * J A> " ""
  24. 24. 01 2 F +J J, F J <>< Y 0$.= !<$< F GJ H ) H JGLJ 2 Z 2FZJ <>< Y 0$.= !<$< F Z 2 .$ Z 2FZ 2L F FF # / O " % " # A> * / 4 3P A> * " S # H / [ V< U " @ -
  25. 25. 01 2
  26. 26. 01 2 B6 / " %" / /! *! * /* " * ? .)# @=># . &
  27. 27. 01 2 A> * %" #? U C< !P < 94 ] F V +G / G#GG# ,LR 4 ]" F V +G" G#GG# ,LS 4] F ^ +J <>< Y 0$.= G ^ G !<$< + >< GJ ] JG, )- +" >< GJ K+]" , JG, >= J#] ,L<8= F R P R _/ G, .$ F :Y& F /
  28. 28. 01 2 A> * / * "#? U-< > $< _ + KK,#_ + KK, -< > $< ^ ;$ .$ 0.$ # * # F % " FG G+ % " FUU % " FRK % " F R % " F 9S,.&<) ^ 0< ! )<@ 0$.= ^ ) ._ #_ !><+__0< !^ ; F , 6<() % +G "WGH_ HGX WGH_ HGXF + + #WGH_ HGX,,HGGD " F "4:: :* * ED: " EGGG,0< ! )<@ 0$.= ^ ) . _ #_ <)- >. < ^-< >>. < ^
  29. 29. 01 2"4:: :* * /4 +JDF "4`:`: `: `: % F/ F ED`: EJ,L +JD " " F`J % `:* " `JF`J "4`:`:* /* 1 / `: TUKT `: /* * `JED`:
  30. 30. -3 45 2 ) B) BC@& ! * 8 "" @& ! @=>
  31. 31. -3 45 2 %DB% FJ J /FJ; 08TJBED E D E D E D: E D E) * D: E D / -E * D: / -E D" E D:" E D: E D E D E6 D: E D E D: E D / -E D: / -E D" E D:" E D: E
  32. 32. -3 45 2:: : W / -: % +,FZ * 2 " : % +,FZ 2X G F:: : W> / -: % +,FG G F " : % +,FG G F X F FF # / O " % " # * G F "
  33. 33. -3 45 2 B@=> @ ? @O
  34. 34. - &) BC " " / /@ *"" " " /
  35. 35. - & /) @ " /0 @ #P / " / = " H P< U
  36. 36. - & # / O - # " U; " / / " 4 % F +G "4:: JED: ED " FJ "4:: 1 :% * JED: " ED G,L %* B
  37. 37. - & F < ! =>L /F $ /<%"+: ^ ^ F G+ Y,GL:/,L F / % + ,L F W XL ;" F +,L ;" W XFJ- # - G BJL ;" W XFJ? - OJL ;" W XFJ # - 4,JL ;" WRXFJV OB B - / OJL ;" WPXFJ - JL ;" WKXFJ_ - JL / $ F ;" W= += +,Y ;" / ,XL" < F +/ $ ,L % F +G "4:: JED: ED " FJ "4:: 1 :% * JED: " ED G,L
  38. 38. - & * % F @! +,L * % +J: : " J# J&. J# J ^ FJHHJQ FJH " < HJQ F Q " F " J,L * % F @! +,L * % +J: : / J# J&. J# J ^ FJHHJQ W XFJH% HJQ F Q " F " J,L
  39. 39. - & F < ! =>L /F $ /<%"+:D FJ+ Y,J FJ 8 8 ^ J:/,L F / % + ,L F W XL L F + ,L +JD / FG "4:: 1 :% " "B FJ H HJQ FJ H H JGEJ,L +JD / FG "4:: : / / GEJ,L
  40. 40. - &! / B / " / : " / :! : " +&-&:6 ! , ; / --
  41. 41. / 2 ) BC0 // / / / %"
  42. 42. / 2DB% FJ JBED FJ 7E D E D E) * ) D: E D E "4:: % " D: E D " E) / * D: " E D / / E 8 D: / / E D" - E # ? U U4 4 (= D:" - E D 6 - E0 # ? U U4 R4 U (= D: 6 - E D E "4:: % " : D: E D/ E< D:/ E D / /< E _ % " D: / /< E D = E _ % " D: = E D EKD: E
  43. 43. / 2$ a $ / @ $0 "
  44. 44. / 2 D ED ED "E FZ "4:: % " : /8 : / B2H D: " ED: ED E "4:: % " : : * D: ED " E / OD: " ED" - E0 # ? U 4P 4 T (= D:" - ED/ E "4:: % " : U: 9: b D:/ E D: E D: ED: E
  45. 45. / 2 D ED EQ L " Q/ L FZ "4:: % " : /8 : / B2H Q L: " Q/ LD: ED E "4:: % " : : * D: ED " E / OD: " ED" - E0 # ? U 4P 4 T (= D:" - ED/ E "4:: % " : U: 9: b D:/ E D: E D: ED: E
  46. 46. / 2> a $ ! => / % %
  47. 47. / 2D "E% 0 FJJL 0 FJ 4`` % JL 0 F @. * +J " /0 . * J,L $ 0 F 0 ." %0 + 0 # # ,L% 0 HF $ 0 $ +,L$ 0 +,L + % 0 ,L FZ "4:: % " : /8 : / B2H % 0D: "E
  48. 48. / 2 C (; " ;$>2 ;$> % +,D FJ JE D E D E D: E D E D E " 8 : ": ^ D: E D E "4:: % " JL" 8 J" G / GJ EJ: ": ^ D: E D" - E0 # 9 . S P4 4 KH R D:" - E D: E D: ED: E - (
  49. 49. / 2! / B V / / // / $ " /
  50. 50. 6 7 & 5 ) BC= " / " "%" / @ $0
  51. 51. 6 7 & 5 "4:: :6 /) = ":
  52. 52. 6 7 & 5= "= " " # "= "= " # .&= " # B
  53. 53. 6 7 & 5 "4:: / / :/
  54. 54. 6 7 & 5 / " / # " -.= "0 * / " / " "
  55. 55. 6 7 & 5= 0 "" ""
  56. 56. 6 7 & 5= 0 "" ""
  57. 57. 6 7 & 5= 0 ""
  58. 58. 6 7 & 5
  59. 59. 6 7 & 5= 0 "" ""& " " ""P[ 0) # a /
  60. 60. 1) B) BC"" / # / # " / "" "
  61. 61. 1 " / / "4:: % " : B F= / ;$> "4:: % " : B F= )- F) /F / !" "#$ !$% !$&" %" (! &) "
  62. 62. 1 B -> "6 /
  63. 63. 1$ / -> / " / / / # " 4DO88 -> " % 4 $ R60 T# K+ 4 K4 P < , 88EDO88 -> " % 4 R6 . K# K + K4 R4RS <- , 88EDO88 -> " % 4 P6 " # 9 + 94KK4PT &- , 88EDO88 -> / a 88EDO88 @=> " K R;+ "4:: %%%% , +%%%, 88E + " O,
  64. 64. 1& / / / "D% 4 " " FJ< " JE D% 4 E D% 4 E< D:% 4 E D:% 4 E D% 4 FJ% 4 /JE D% 4 %> / FJK J:E D% 4" FJ H_ HJ:E D:% 4 E D:% 4 " " E
  65. 65. 1 ""V # /C ")= S ( 1
  66. 66. 1
  67. 67. 7 7 / ) ) B) BC * / #" / # 1 # "
  68. 68. 7 7 / )& % / # / " %> "6 & ! / = /> " -2& -2> % -2; / -
  69. 69. 7 7 / )0 " & ;$> " R" ;$> F+ -, F+ -, F+ ,"4:: : " "B F8RQ F K T RPK99Q F U "4:: * : /:B"F UT - $ L8,
  70. 70. 7 7 / )
  71. 71. 7 7 / )
  72. 72. 7 7 / )
  73. 73. 7 7 / ) B & ! 2 " / H= " "" / / / "( H
  74. 74. +) B) BC "" " /" 2 "
  75. 75. + /) " /! / : /; / " + -< ,0 / / ") " /. / >: > /0 / "< / % "
  76. 76. + B= " # / /=% / " /
  77. 77. ) 7& %(= " % "" / / + ,; "" /- / " "
  78. 78. 5 ) 7 % 80 # " " " "- " # " 5 76 # 2
  79. 79. 47 3 " V3 - 9: 2. " V3 - 9: 2 9;< ! /3 13 & + 9 < 9+ / = /3 4 9 9+ /3 3 4 /3 3 )7 $3 9 3 9/
  80. 80. 5 ) 7 % 8 $ " = % + ) $& ( ) > *! ! " . $ 4 "# "
  81. 81. * " 4_ *- $ # % " / "" 4 <" # P / #- #

×