CSRF. Danger. Detection. Defenses презентация
Содержание
- 2. Overview Discussion of the “Same Origin Policy” Overview of the “Sleeping
- 3. The Browser “Same Origin” Policy
- 4. Cross-Site Request Forgery
- 5. How Does CSRF Work? Tags <img src=“https://bank.com/fn?param=1”> <iframe src=“https://bank.com/fn?param=1”> <script src=“https://bank.com/fn?param=1”>
- 6. Credentials Included
- 7. New Tool: OWASP CSRFTester Test your applications for CSRF Record and
- 8. DEMO: OWASP CSRFTester
- 9. What Can Attackers Do with CSRF? Anything an authenticated user can
- 10. Using CSRF to Attack Internal Pages
- 11. Misconceptions – Defenses That Don’t Work Only accept POST Stops simple
- 12. New Tool: OWASP CSRFGuard 2.0 Adds token to: href attribute src
- 13. DEMO: OWASP CSRFGuard 2.0
- 14. Similar Implementations PHP CSRFGuard PHP Implementation of CSRFGuard http://www.owasp.org/index.php/PHP_CSRF_Guard JSCK PHP
- 15. DEMO: Cross-Site Scripting vs. CSRFGuard
- 16. Enterprise CSRF Mitigation Strategy Balance Between Security, Usability, and Cost
- 18. Extra: How Widespread Are CSRF Holes? Very likely in most web
- 19. Extra: Real World CSRF Examples <iframe style="display:none" src="http://www.google.com/setprefs?hl=xx-klingon&submit2=Save%20Preferences%20&prev=http://www.google.com/&q=&submit= Save%20Preferences%20"></iframe>
- 20. Extra: CSRF Defenses CAPTCHA Attacker must know CAPTCHA answer Assuming a
- 21. Скачать презентацию
Слайды и текст этой презентации
Слайд 1
Описание слайда:
Cross-Site Request Forgery: Danger, Detection, and Defenses
Eric Sheridan
Aspect Security, Inc.
[email protected]
Слайд 2
Описание слайда:
Overview
Discussion of the “Same Origin Policy”
Overview of the “Sleeping Giant”
The Introduction of
2 New OWASP Tools
A Series of New WebGoat Labs
Enterprise CSRF Mitigation Strategy
Слайд 3
Описание слайда:
The Browser “Same Origin” Policy
Слайд 4
Описание слайда:
Cross-Site Request Forgery
Слайд 5
Описание слайда:
How Does CSRF Work?
Tags
<img src=“https://bank.com/fn?param=1”>
<iframe src=“https://bank.com/fn?param=1”>
<script src=“https://bank.com/fn?param=1”>
Autoposting Forms
<body onload="document.forms[0].submit()">
<form method="POST" action=“https://bank.com/fn”>
<input type="hidden" name="sp" value="8109"/>
</form>
XmlHttpRequest
Subject to same origin policy
Слайд 6
Описание слайда:
Credentials Included
Слайд 7
Описание слайда:
New Tool: OWASP CSRFTester
Test your applications for CSRF
Record and replay transactions
Tune the recorded test case
Run test case with exported HTML document
Test case alternatives
Auto-Posting Forms
Evil iFrame
IMG Tag
XMLHTTPRequest
Link
Слайд 8
Описание слайда:
DEMO: OWASP CSRFTester
Слайд 9
Описание слайда:
What Can Attackers Do with CSRF?
Anything an authenticated user can do
Click links
Fill out and submit forms
Follow all the steps of a wizard interface
No restriction from same origin policy, except…
Attackers cannot read responses from other origins
Limited on what can be done with data
Severe impact on accountability
Log entries reflect the actions a victim was tricked into executing
Слайд 10
Описание слайда:
Using CSRF to Attack Internal Pages
Слайд 11
Описание слайда:
Misconceptions – Defenses That Don’t Work
Only accept POST
Stops simple link-based attacks (IMG, frames, etc.)
But hidden POST requests can be created with frames, scripts, etc…
Referer checking
Some users prohibit referers, so you can’t just require referer headers
Techniques to selectively create HTTP request without referers exist
Requiring multi-step transactions
CSRF attack can perform each step in order
URL Rewriting
General session id exposure in logs, cache, etc.
None of these approaches will sufficiently protect against CSRF!
Слайд 12
Описание слайда:
New Tool: OWASP CSRFGuard 2.0
Adds token to:
href attribute
src attribute
hidden field in all forms
Actions:
Log
Invalidate
Redirect
Слайд 13
Описание слайда:
DEMO: OWASP CSRFGuard 2.0
Слайд 14
Описание слайда:
Similar Implementations
PHP CSRFGuard
PHP Implementation of CSRFGuard
http://www.owasp.org/index.php/PHP_CSRF_Guard
JSCK
PHP & JavaScript implementation
http://www.thespanner.co.uk/2007/10/19/jsck/
Слайд 15
Описание слайда:
DEMO: Cross-Site Scripting vs. CSRFGuard
Слайд 16
Описание слайда:
Enterprise CSRF Mitigation Strategy
Balance Between Security, Usability, and Cost
Слайд 17
Описание слайда:
Слайд 18
Описание слайда:
Extra: How Widespread Are CSRF Holes?
Very likely in most web applications
Including both intranet and external apps
Including Web 1.0 and Web 2.0 applications
Any function without specific CSRF defenses is vulnerable
How do victims get attacked?
Victim simply opens an infected webpage, HTML file, or email
Single Sign On (SSO) extends “authenticated user”
CSRF recently found in 8 security appliances
Including CheckPoint
Слайд 19
Описание слайда:
Extra: Real World CSRF Examples
<iframe style="display:none"
src="http://www.google.com/setprefs?hl=xx-klingon&submit2=Save%20Preferences%20&prev=http://www.google.com/&q=&submit= Save%20Preferences%20"></iframe>
Слайд 20
Описание слайда:
Extra: CSRF Defenses
CAPTCHA
Attacker must know CAPTCHA answer
Assuming a secure implementation
Re-Authentication
Password Based
Attacker must know victims password
If password is known, then game over already!
One-Time Token
Attacker must know current token
Very strong defense!
Unique Request Tokens
Attacker must know unique request token for particular victim for particular session
Assumes token is cryptographically secure and not disclosed.
/accounts?auth=687965fdfaew87agrde …
Скачать презентацию на тему CSRF. Danger. Detection. Defenses можно ниже:
