Is the Web at Risk?

is the web @ risk ?
World Internet Project Meeting 2010

ISCTE-IUL/SoTA/ADETTI-IUL Carlos Serrão
Instituto Superior de Ciências do Trabalho e da Empresa carlos.serrao@iscte.pt
Instituto Universitário de Lisboa carlos.j.serrao@gmail.com
School of Technology and Architecture
ADETTI-IUL http://www.carlosserrao.net
http://blog.carlosserrao.net
http://www.linkedin.com/in/carlosserrao

Is the Web …
… at risk?
… a risk?
… putting YOU at risk?

WHY? HOW?
WHEN?

The Internet…
… and the WWW,

in the beg inning .

in the beginning...

Vinton Gray Cerf Robert Elliot Kahn

… a.k.a. the “Internet fathers”

The Internet was created…
… as an ubiquitous

… decentralized

… standardized

… global

… interconnected

… digital

… communications channel.

in the beginning...

(Sir) Tim Berners Lee

… a.k.a. the “WWW father”

The WWW was created!

A system of
interlinked
hypertext documents
accessed via the
Internet.

Infinite worldwide
knowledge access.

evolving, growing
network
Small data part on Large amounts of Data on the Cloud
a specific web-site data on a large
(or limited number number of sites Applications on the
of web-sites) Applications on the Web and Cloud
desktop and Web
Applications on the
(more and more) Data almost
desktop
Part of the data inexistent on the
Most data is on the still on desktop desktop (still on
desktop (but also mobile) mobile)

Data processing on Data processing on Data processing
the desktop the desktop, but almost inexistent
also on the web

user

security++
  what do we have today?
  anti-virus

  anti-malware

  anti-spyware

  firewalls

  intrusion detection systems
  …

  are they enough?

security++
  YES, but…
  dothey protect the user from the web
applications?

  cana Web application be compromised to
hurt legitimate users?

  sure it can.

security++
  How?
  Do you trust your favorite web-applications?
  Google
  Gmail

  Doyou trust your favorite social-web
applications?
  Facebook
  Twitter

  Do you trust your homebanking?
  Do you trust your government web-sites?

security++
The security perimeter has huge
security holes in the application
Application Layer

layer

Legacy Systems

Human Resrcs
Web Services
Directories
Custom Developed

Databases
Application Code

Billing
APPLICATION
ATTACK

App Server
Web Server
Network Layer

Hardened OS

Firewall
Firewall

security trends

problem types typical problems on web apps

the security risks

http://www.owasp.org/index.php/Top_10

security risks
  considering the three most important
  A1: Injection
  A2: Cross Site Scripting (XSS)

  A5: Cross Site Request Forgery (CSRF)

A1: Injection
what if?

A1: Injection
what if?

SELECT * FROM users usr
WHERE usr.username = ‘admin’;--’
AND usr.password=’bb21158c733229347bd4e681891e213d94c685be’

any input from the
web app user can be
an attack vector

A2: Cross Site Scripting (XSS)
  injecting malicious payload on the web
app from the end-user side to be
redirected to other users (victims)

A2: Cross Site Scripting (XSS)
1 Attacker sets the trap – update my profile

Application with
stored XSS
Attacker enters a
vulnerability
malicious script into a
web page that stores
the data on the server

Knowledge Mgmt
Communication
Administration

Bus. Functions
E-Commerce
Transactions
2 Victim views page – sees attacker profile

Accounts
Finance
Custom Code

Script runs inside
victim’s browser with
full access to the DOM
and cookies

3 Script silently sends attacker Victim’s session cookie

A5: Cross Site Request Forgery (CSRF)

  an attacker can build its own malicious
website and initiate request on the user’s
browser


Attacker sets the trap on some website on the internet
1 (or simply via an e-mail)

Application with CSRF
Hidden <img> tag vulnerability
contains attack
against vulnerable
site

Knowledge Mgmt
Communication
Administration

Bus. Functions
Transactions

E-Commerce
Accounts
Finance
While logged into vulnerable site,
2 victim views attacker site
Custom Code

3
Vulnerable site sees
<img> tag loaded by legitimate request
browser – sends GET from victim and
request (including performs the action
credentials) to requested
vulnerable site


Alice transfer 100€ to Bob
Bob
through bank.com

POST http://bank.com/transfer.do HTTP/1.1
...
...
...
Content-Length: 19;

acct=BOB&amount=100

realizes that the same bank.com web application can execute
Pirate the transfer using a URL with parameters
GET http://bank.com/transfer.do?acct=BOB&amount=100 HTTP/1.1

will try to use Alice to transfer 100.000€ to its own account
http://bank.com/transfer.do?acct=MARIA&amount=100000

sends an HTML email to Alice with an URL to click
<a href="http://bank.com/transfer.do?acct=MARIA&amount=100000">View my
Pictures!</a>

or, sends an HTML email to Alice with a image to hide the attack
<img src="http://bank.com/transfer.do?acct=MARIA&amount=100000" width="1"
height="1" border="0">

Alice if Alice is authenticated at bank.com with an active session
the transfer is performed

consequences

This is serious!!!

And we are just
looking at the
tip of the
iceberg!

[quick] conclusions
  Extra-care with the web applications you
trust your data
  Extra-care on the way you handle your
email
  Always act suspicious upon something

“strange” on the web
  WebApp developers take care on what you

do – your code is part of the security
perimeter

Is the Web at Risk?

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (7)

Semelhante a Is the Web at Risk?

Semelhante a Is the Web at Risk? (20)

Mais de Carlos Serrao

Mais de Carlos Serrao (20)

Último

Último (20)

Is the Web at Risk?