I Want These * Bugs Off My * Internet

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

I WANT THESE * BUGS
OFF MY * INTERNET
Dan Kaminsky
Chief Scientist
White Ops

So, Defcon, Again
• Been coming here for ~15 years
• No, really, I do talk about a lot more things than just DNS
• Heh, th...

I Like Hacking
• The primary thing hackers break are assumptions
• We’re the people who manipulate how systems really work...

I Like The Web
• HTML was the first complex document format that wasn’t accidentally
fuzzable
• Whatever you put into it, ...

That Is Not How Mobile Works
• Not to say Mobile is “bad”
• It’s optimized for using a much smaller set of services
• Must...

An Amazing Security Model (Really)
• The Browser represents a “Neutral Broker” that implements 2 ideas
• 1) Same Origin Po...

The “Malvertising” Trap
• “Everybody should run ad blockers, because advertisements might
contain dangerous content”
• Thi...

THAT BEING SAID
• “Everybody should run ad blockers, because advertisements are
annoying and make the web slow”
• Totally ...

The Same Origin Policy can be a problem
• This is a surprising finding, even to me
• Goal: Protect the user’s interests
• ...

Yeah, we’re hackers, this is a web page CPU
monitor, and that’s an IETF SHOULD NOT

By comparison…

How it works
• nice.js (simplified)
• setInterval(
function(){
var now = Date.now();
console.log(now-window.prev-250);
win...

How useful is nice.js?
• A slow web is a dead web
• I like the web
• Nice.js lets scripts easily delay their execution unt...

Could nice.js be “fixed”?
• Difficult to fix
• The stuff that’s being blocked here is fundamentally single threaded
• Chro...

Let’s step back for a second
• What did I just calculate?
• “Given this hack, what should browser developers do?”
• Turns ...

Another thing SOP-Induced blindness has
allowed…
• 1) Buy ad space on a popular site
• 2) ???
• 3) Profit
• Anyone here kn...

Ad Stuffing Gnomes
• 1) Buy ad space on a popular site
• 2) Put ten other ads inside/underneath your ad
• Top Frame: Some ...

So, Viewability
• Same Origin Policy means nobody can tell stuffing is happening
• Ads can’t tell they’re invisible
• Publ...

“Viewability” is just Clickjacking w/o the Click
• Attacks against viewability occur when
just the loading of content is e...

Off-site navigation is a terrible design
(But Paypal can only guarantee no malice on eBay)
“In Context” on eBay – just hit...

Popups are terrible design.
(But Twitter is afraid of clickjacked retweets)

Some bugs need to be judged by the crap
they create in their wake
• We tend to “fix” clickjacking by making it impossible ...

Adobe destroyed Clickjacking
(For Camera and Microphone)
(+ means can click, - means cannot click)

Works through Iframes just fine
(Same filters, but on outer iframe vs plain inside)

Moving objects (that are, say, following the
mouse) must stay in place for a few seconds in
view of user for input to be a...

they make photoshop they can tell by the pixels
(Adobe is semi-fuzzily comparing expected vs.
actual rendered output to th...

So…
• I guess Flash can do what HTML5 can’t…again?
• Uh, no
• You never want to read pixels back from the GPU
• GPU == 10 ...

We Too Can Fix Things
• It’s not like we can’t patch browsers like Adobe can patch Flash
• HTML5 has been working on fixin...

I’m becoming an W3C invited expert,
because…
I WANT THESE * CLICKJACKING BUGS
OFF MY * WEB
Ask me how

Layers of Abstraction
• Browsers can’t efficiently know what pixels are being presented to the
user (because the GPU is fi...

What you see

What your computer sees (Firefox 3D view)

Maybe your computer could see something
else
• Pixel Scraping is an attempt at auditing
• So many ways to draw pixels in H...

Then let me explain why you never
use the word “just” when it comes to
browsers, or anything that might be
hard.
Browsers
...

Here’s a tweet (inside a bunch of hidden iframes
being nasty). If you click it, it fires a popup.

That tweet, with a stock browser, in various
possibly unfriendly environments

Same Tweet, Under IronFrame (screen not
recently scrolled). Red=Not 100% Visible

Now, we scroll the top window.
Yellow==“My size or position changed recently”
Red or Yellow == Interaction is blocked

The iframe follows the mouse? No problem!
Yellow (and input blocking) in motion
Clear (and interactive) once settled in

Handling Changing States:
Events, not Fixed Policies
• That’s the other half of IronFrame
• Instead of applying fixed poli...

We have a God layer
What if there are two Gods?
• What if two layers both try to promote into the same space?
• No problem...

Just to show off a bit…
Opacity tricks? No problem.

Drop shadows from a faraway Element?
CSS filter blur? Done and done.

Complex clip paths? Nope
Zoom? Catch that too

RotateY(90deg?) Sure, nope.

Scale3D literally flipping it and reversing it and
NOPE NOPE NOPE

Visibility Hidden?
Visibility Restored.

Securitay by design is a thing
Not saying perfect. But all those
were fixed without special cases.
No popups necessary

Let’s talk gory details. Starting with what
does it actually mean to “move a layer”.
• We’re going to focus on Blink here,...

What do we have to do
• Satisfy three requirements
• 1) Promote content to the top layer
• 2) Shrink that content so it’s ...

What do we have to work with…
• Node
• Element
• Document
• DOMWindow
• LocalDOMWindow
• Page
• ChromeClient
• FrameTree
•...

OK, we can simplify
• Three layers contain almost all of what we need
• Document
• LayoutTree of LayoutObjects
• LayerTree...

Document: Just the DOM
• It’s the Document Object Model,
what did you expect?
• You can of course access it from
C++
• Any...

LayoutObject: A fast OM that still knows what
sort of elements it contains
internals.elementLayoutTreeAsText(
imgdoc.docum...

Anyone here pixel scrape for web regression
tests? Because LayoutTree dumping is better.

DeprecatedPaintLayer / GraphicsLayer:
An OM that only knows surfaces to
paint/clip/scroll
internals.layerTreeAsText(docume...

Layer Tree After style.transform =
“translatez(0)”
Looks like a lot…
• Most of these surfaces don’t
have drawsContent set
...

What I’ve found
• Everything in IronFrame could be implemented at Document,
LayoutObject, or GraphicsLayer
• For various d...

IronFrame in English: Find Your
DocumentElement
• 1) Start with the documentElement inside an iframe’s Document
object
• W...

IronFrame in English: Raise your
GraphicsLayer
• 2) Find the GraphicsLayers for both the content to be promoted, and
the r...

IronFrame in English: Your GraphicsLayer is
too big! Measure how bad it is.
• 4) Figure out how big that documentElement i...

IronFrame in English: Don’t forget the
Viewport!
• 6) Figure how much the viewport clips you
• Just because we’re somewher...

IronFrame in English: Shrink your
GraphicsLayer
• 7) Apply Bounds
• boundsInViewportSpace() takes all scrolling into accou...

IronFrame in English: Report back!
• 9) Report back the Viewport and Visible Portion
• I happen to send this back over an ...

It’s so easy!
That’s why you never say “just”.
I said just
You can’t spell just without js

Some Issues
• Need to actually get this into the compositing pipeline
• Presently a JS call (requestVisibility) rather tha...

Biggest Issue: Do we really want to be forcing
things to be drawn on top?
• Fail Closed
• Whatever we report, that’s actua...

Well, drop shadows are a thing
(thanks, Jesse Ruderman)

Could I just promote the part of the layer I
think that’s on top?
• Even if I deeply analyze
GraphicsLayer to separate the...

One more thing
• Thus far, somebody can still draw a fake Twitter
• They’re just pixels
• Who cares, their fake doesn’t ha...

A New Freedom
• Iframes have always had input exclusivity
• Keyboard and mouse to a frame, only goes to that frame
• Ifram...

We can update the address bar when the user is
interacting with a secured frame.
(That’s not photoshopped.)

So
• We can kill clickjacking without breaking what makes the web special
• We can do crazy things as hackers – it’s not j...

Couple final tips (if there’s time)
• 1) Even (especially) if you’re a White Hat, you don’t need to play all
secretive whe...

Look for the debugging tools
• You’re not the only one who’s tried to change something here
• Internals.cpp is as close as...

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

View on SlideShare

1 of 75 Ad

1 of 75 Ad