• Home

  • Documents

  • Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but...
32
Origin Policy Enforcement in Modern Browsers A Case Study in Same Origin Implementations Frederik Braun Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 1 / 25

Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

  • Upload
    others

  • View
    3

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Origin Policy Enforcement in Modern BrowsersA Case Study in Same Origin Implementations

Frederik Braun

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 1 / 25

Page 2: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Table of Contents

1 about:me

2 MotivationAmbient AuthenticationThe Severity of a Same Origin Policy Bypass

3 The Same Origin PolicyWhat is an Origin?What is the Same Origin Policy?Examples

4 EvaluationSOP Bypass: Firefox (2007)SOP Bypass: Flash (2010)SOP Bypass: Java 7 Update 5-X (2012)

5 Conclusion

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 2 / 25

Page 3: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Table of Contents

1 about:me

2 MotivationAmbient AuthenticationThe Severity of a Same Origin Policy Bypass

3 The Same Origin PolicyWhat is an Origin?What is the Same Origin Policy?Examples

4 EvaluationSOP Bypass: Firefox (2007)SOP Bypass: Flash (2010)SOP Bypass: Java 7 Update 5-X (2012)

5 Conclusion

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 3 / 25

Page 4: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Frederik Braun

Dipl. Ing. in IT-Security at Ruhr-Uni Bochum (2012)I this research!I https://frederik-braun.com/thesis

Security Engineer at Mozilla in Berlin

likes to play CTFs (hi FluxFingers!)

@freddyb on twitter

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 4 / 25

https://frederik-braun.com/thesis
Page 5: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Table of Contents

1 about:me

2 MotivationAmbient AuthenticationThe Severity of a Same Origin Policy Bypass

3 The Same Origin PolicyWhat is an Origin?What is the Same Origin Policy?Examples

4 EvaluationSOP Bypass: Firefox (2007)SOP Bypass: Flash (2010)SOP Bypass: Java 7 Update 5-X (2012)

5 Conclusion

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 5 / 25

Page 6: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Ambient Authentication

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 6 / 25

Page 7: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

The Severity of a Same Origin Policy Bypass

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 7 / 25

Page 8: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Table of Contents

1 about:me

2 MotivationAmbient AuthenticationThe Severity of a Same Origin Policy Bypass

3 The Same Origin PolicyWhat is an Origin?What is the Same Origin Policy?Examples

4 EvaluationSOP Bypass: Firefox (2007)SOP Bypass: Flash (2010)SOP Bypass: Java 7 Update 5-X (2012)

5 Conclusion

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 8 / 25

Page 9: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

What is an Origin?

scheme hostname port

http://www.example.com:8080/

origin

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 9 / 25

Page 10: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

The Same Origin Policy (SOP)

“An ‘origin’ (...) is often used as the scope of authority or privilege by useragents. ” — Barth

“The same-origin policy is the most important mechanism we have to keephostile web applications at bay, but it’s also an imperfect one.” —Zalewski

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 10 / 25

Page 11: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help

3

https://www.example.com/ 7

about:blank 3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 12: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/ 7

about:blank 3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 13: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/

7

about:blank 3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 14: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/ 7

about:blank 3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 15: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/ 7

about:blank

3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 16: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/ 7

about:blank 3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 17: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/ 7

about:blank 3

http://www.example.com:8000/phpMyAdmin

7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 18: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Examples

Compare for http://www.example.com/

URL same-origin?

http://www.example.com/help 3

https://www.example.com/ 7

about:blank 3

http://www.example.com:8000/phpMyAdmin 7/3a

aInternet Explorer doesn’t care about ports.

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 11 / 25

Page 19: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

JavaScript Object Hierarchy

window

history document

location frames

frame (ebay) frame (amazon)

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 12 / 25

Page 20: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

No Way Out? - Exceptions

Cookies

window.locationsetter

window.namepersists

document.domain

Internet ExplorerZones

CORS

JSONP

...

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 13 / 25

Page 21: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

SOP Wrap-Up

Summary

read access

vendor specific

JavaScript Engine (Object Capability) vs. DOM (Access Control)

the SOP is highly inhomogenous

no consistent reference implementation

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 14 / 25

Page 22: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Table of Contents

1 about:me

2 MotivationAmbient AuthenticationThe Severity of a Same Origin Policy Bypass

3 The Same Origin PolicyWhat is an Origin?What is the Same Origin Policy?Examples

4 EvaluationSOP Bypass: Firefox (2007)SOP Bypass: Flash (2010)SOP Bypass: Java 7 Update 5-X (2012)

5 Conclusion

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 15 / 25

Page 23: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

All SOP Flaws are alike (CVE-2007-0981)

DNS, ASCIIZ

JavaScript, UTF-16

harmless.com

Browser Server B

harmless.com\x00.attacker.com

attacker.com

Server A

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 16 / 25

Page 24: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

All SOP Flaws are alike (CVE-2010-2179)

HTTP API

Flash Plugin

harmless.com

Browser Server B

http://[email protected]

attacker.com

Server A

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 17 / 25

Page 25: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

All SOP Flaws are alike (CVE TBA)

HTTP API

Java URL Handler

harmless.com

Browser Server B

jar:http://harmless.com/foo.odt

attacker.com

Server A

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 18 / 25

Page 26: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Demo

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 19 / 25

Page 27: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Table of Contents

1 about:me

2 MotivationAmbient AuthenticationThe Severity of a Same Origin Policy Bypass

3 The Same Origin PolicyWhat is an Origin?What is the Same Origin Policy?Examples

4 EvaluationSOP Bypass: Firefox (2007)SOP Bypass: Flash (2010)SOP Bypass: Java 7 Update 5-X (2012)

5 Conclusion

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 20 / 25

Page 28: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Conclusion: Same Origin Policy

an inconsistent policy

vendor specific

theoretically, it’s a black list

plugins

late 2012: Java in nearly 70% of all browsers

but only 0.2% of websites

2013: exploits, Click-To-Play, ..

But: There are safe & well designed security models on the horizon

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 21 / 25

Page 29: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Future Work: Automation?

Picture by Jason Huggins on flickr

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 22 / 25

Page 30: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

“This same origin policy is the dumbest thing ever. . . . All this ‘protection’serves to do is aggravate legitimate developers trying to get JavaScript todo the simplest of tasks.” — Somebody on stackoverflow.com

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 23 / 25

Page 31: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

Thanks

Page 32: Origin Policy Enforcement in Modern Browsers...late 2012: Java in nearly 70% of all browsers but only 0.2% of websites 2013: exploits, Click-To-Play, .. But: There are safe & well

References

Barth, Adam.The web origin concept.http://tools.ietf.org/html/rfc6454, December 2011.

Q-Success.Usage of client-side programming languages for websites.http://w3techs.com/technologies/overview/client side language/all.Last visited 2012-10-17.

Michal Zalewski.The Tangled Web: A Guide to Securing Modern Web Applications.No Starch Press, November 2011.

For all references please see full thesis onhttps://frederik-braun.com/thesis

Frederik Braun (Ruhr-Uni Bochum/Mozilla) Origin Policy Enforcement August 23, 2013 25 / 25

https://frederik-braun.com/thesis

Browsers hector

Browsers hector

Education
TCP Exploits

TCP Exploits

Documents
Genome Browsers

Genome Browsers

Documents
Common Exploits

Common Exploits

Documents
But what about old browsers?

But what about old browsers?

Technology
AR Browsers

AR Browsers

Technology
Browsers Mobile

Browsers Mobile

Internet
The Ether Wars: Exploits, counter-exploits and honeypots ... CON 27/DEF CON 27... · ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum 2 About

The Ether Wars: Exploits, counter-exploits and honeypots ... CON 27/DEF CON 27... · ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum 2 About

Documents
Invasaocom exploits

Invasaocom exploits

Technology
TO HACK AN ASP .NET WEBSITE? HARD, BUT … · ASP.NET Peculiarities Special catalogs and files: -App_Browser –browsers definition (*.browsers) -App_Code – a source code of helper

TO HACK AN ASP .NET WEBSITE? HARD, BUT … · ASP.NET Peculiarities Special catalogs and files: -App_Browser –browsers definition (*.browsers) -App_Code – a source code of helper

Documents
web browsers

web browsers

Documents
φυλλομετρητές Browsers

φυλλομετρητές Browsers

Documents
Adobe Dreamweaver CS4: Learning the Tools · Adobe Dreamweaver CS4: Learning the Tools ... browsers will be used to preview the web ... but the two most common browsers are Mozilla

Adobe Dreamweaver CS4: Learning the Tools · Adobe Dreamweaver CS4: Learning the Tools ... browsers will be used to preview the web ... but the two most common browsers are Mozilla

Documents
Secure browsers

Secure browsers

Technology
Writing exploits

Writing exploits

Technology
Browsers (2011)

Browsers (2011)

Education
Malware - cs.stevens.edu · Where does Malware come from? Malicious scripts on websites that exploit security holes in browsers (Exploits) Security vulnerabilities in operating systems

Malware - cs.stevens.edu · Where does Malware come from? Malicious scripts on websites that exploit security holes in browsers (Exploits) Security vulnerabilities in operating systems

Documents
Mobile Browsers

Mobile Browsers

Documents
Browsers jéssica

Browsers jéssica

Documents
φυλλομετρητεσ Browsers

φυλλομετρητεσ Browsers

Documents
You Can Run but You Can’t Read: Preventing Disclosure Exploits in Executable Code

You Can Run but You Can’t Read: Preventing Disclosure Exploits in Executable Code

Software
Software Exploits

Software Exploits

Documents
Simulate Browsers

Simulate Browsers

Technology
Les exploits

Les exploits

Documents