SlideShare ist ein Scribd-Unternehmen logo
1 von 33
Downloaden Sie, um offline zu lesen
Scriptless Attacks
Stealing the Pie without touching the Sill



Mario Heiderich, Felix Schuster, Marcus Niemietz,
Jörg Schwenk, Thorsten Holz
ACM CCS 2012

HGI / Chair for Network and Data Security
Ruhr-University Bochum
mario.heiderich@rub.de || @0x6D6172696F
Our Dear Speaker
       ●   Dr.-Ing. Mario Heiderich
           ●   Researcher and Post-Doc, Ruhr-Uni Bochum
               –   PhD Thesis on Client Side Security and Defense
           ●   Founder of Cure53
               –   Penetration Testing Firm
               –   Consulting
               –   Simply the Best Company of the World
           ●   Published author and international speaker
               –   Specialized in HTML5 and SVG Security
               –   JavaScript, XSS and Client Side Attacks
           ●   HTML5 Security Cheatsheet
               –   @0x6D6172696F
               –   mario@cure53.de
Background
Cross Site Scripting

●   Lots of talks have been held
●   Plenty of research has been done
    ●   Traditional injections
    ●   Attacks from outer space
    ●   XSS, XAS, XDS, XSSQLI, SWXSS, … you name it!
    ●   Defense mechanisms on multiple layers
    ●   Network, Server, Client and what not...
        –   CSP, NoScript, AntiSamy and HTMLPurifier, Tripwires, Browser XSS Filters
        –   mod_security, PHPIDS, some (often nonsense) WAF products
●   But why use scripting at all?
Topics Today

●   Scriptless Attacks in your Browser
    ●   Attacks bypassing NoScript
    ●   Attacks bypassing XSS Filters
    ●   Attacks bypassing Content Security Policy
●   Thought Experiment
    ●   What if we defeat XSS?
    ●   What attack surface will remain?
    ●   Will it make a difference?
Happy Injections
Exploits

●   Three Chapters to be presented

    ●   Chapter 1: These simple tricks
    ●   Chapter 2: Advanced Class
    ●   Chapter 3: For Science!
Chapter one




    [ These simple Tricks ]
CAPCTHA Of Doom




●   Seems legit?
●   See it live: http://heideri.ch/opera/captcha/
Analysis
●   What really happens
    ●   The attacker, Clive, injects CSS...
        –   input[type=password]{content:attr(value)}
    ●   Then he includes a custom SVG font
        –   @font-face {font-family: X;src: url(x.svg#X)
            format("svg");}
    ●   The attacker simply flips characters
        –   s becomes x, e becomes w, c becomes @ …
    ●   By thinking it's a CAPTCHA...
    ●   … Alice submits her password to the attacker
Validation
CSS + RegEx = ?
●   Old but gold – brute-forcing passwords
    ●   But this time with CSS3 and HTML5
    ●   The secret ingredient here is „validation“
    ●   Brute-force with RegEx!
    ●   Let's have a look
    ●   DEMO


●   Good thing it works on all browsers
    ●   Limited by smart password managers though
Chapter TWO




    < Advanced Class >
SVG Keylogger
●   Just a harmless login page




●   Behaving strange on closer inspection though...
    ●   Let's check that http://html5sec.org/keylogger
How is it done?

●   Attacker injected some inline SVG code
    ●
        SVG knows the <set> element
    ●
        The <set> element can listen to events
    ●   Even keystrokes
    ●   The feature is called accessKey() (W3C)
    ●   JavaScript is turned off – it's „no script“ anyway
    ●   But the keystroke scope is hard to define

    ●   In Firefox it's the whole document
CSS + URL + Regex = ?
●
    More info we can steal
●
    CSS3 and @document
●   Allows to cast a Regex on the loaded URL
●
    Then deploy custom CSS

●   We can steal stuff now
●   But we can do even more ;)
    ●   http://html5sec.org/xssfilter/
    ●   Is that all?
    ●   Maybe not
More Madness
●   HTML5's dirname attribute
●   The most useless attribute ever
●   Worse than formaction...   which one should know or look up :)




●   Meant to tell the server about...
        *drumroll*
●   Text-Flow Direction!
●   Also does cruel things to HTTP requests
    ●   DEMO
Chapter Three




      < For Science! >
CSRF Tokens
●   Everybody knows CSRF
    ●   One domain makes a request to another
    ●   The user is logged into that other domain
    ●   Stuff happens, accounts get modified etc.


●   How to we kill CSRF?
    ●   Easily – we use tokens, nonces
    ●   We make sure a request cannot be guessed
    ●   Or brute-forced – good tokens are long and safe
CSRF and XSS

●   CSRF and XSS are good friends
    ●   JavaScript can read tokens from the DOM
    ●   Bypass most CSRF protection techniques




    ●   But can we steal CSRF tokens w/o JS?
Already done

●
    SDC, Gaz and thornmaker already did it
●   Check out http://p42.us/css/
●
    They used CSS
    ●   Basically a brute-force via attribute selectors
    ●
        input[value^=a]{background:url(?a)}
    ●   If the server catches GET /?a...
    ●   The first character is an a
●   But then what?
●
    There's no „second or Nth character selector“
●
    They had to go input[value^=aa]{background:url(?aa)}
Ingredients

●   Some links with a secret CSRF token
●   A CSS injection
    ●
        height
    ●
        width
    ●
        content:attr(href)
    ●
        overflow-x:none
    ●
        font-family
    ●   And another secret ingredient
DEMO
●   http://html5sec.org/webkit/test
The Magic Part
●   The secret ingredients
    ●   Custom SVG font – one per character
    ●   An animation – decreasing the box size
    ●   The overflow to control scrollbar appearance
    ●   And finally...

    ●   Styled scrollbar elements – WebKit only
        div.s::-webkit-scrollbar-track-piece
        :vertical:increment {background:red url(/s)}
Those Fonts

●   There's more we can do with custom fonts
    ●   HTML5 recommends WOFF
    ●
        All done via @font-face


●   WOFF supports an interesting feature
    ●   Discretionary Ligatures
    ●   Arbitrary character sequences can become one character
    ●   Imagine.. C a t become a cat icon. Or... d e e r a lil' deer
Ligatures




●   http://ie.microsoft.com/testdrive/graphics/opentype/opentype-monotype/index.html
Fontforge
Attack Fonts
●   We can thus build dictionary fonts!
    ●   One character per password for example
    ●   No problem for a font to handle 100k+ items
●   Map the string s u p e r s e c r e t into one char
●   Make everything else invisible
●   If the character is visible, we have a hit
    ●   If not the password is not in the list/font




●   How can we find out if nothing – or just one character is
    visible?
Go CSS!
●   Remember the smart scrollbars?
    ●   Same thing all over again
    ●   But this time for all browsers please
●   CSS Media Queries to the rescue!
    ●
        We can deploy selective CSS depending on:
        –   Viewport width, viewport height
        –   @media screen and (max-width: 400px){*{foo:bar}}
    ●   Every character gets a distinct width, and/or height
    ●
        Once scrollbars appear, the viewport width gets reduced
    ●   By the width of the scrollbar
    ●   Some Iframe tricks do the job and allow universal scrollbar detection


●   That's all we need _:D
Demo




       DEMO
Conclusion

●   Scriptless Attacks versus XSS
    ●   Not many differences in impact
    ●   More common injection scenarios
    ●   Affecting sandboxes with HTML5
    ●   Information leaks by design
●   Hard to detect and fix
●   Timing and Side-Channel
●   NoScript to the rescue?
Defense

●   How to protect against features?
●   How to protect against side-channels
    ●   Reduce data leakage?
    ●   Build better sandboxes?
    ●   Extend SOP to images and other side channels,
    ●   CSP maybe? One day?
●   XFO and Frame-Busters
●   Better CSS filter tools are needed!
●   Know your spec, contribute!
Fin

●   Questions?
●   Discussion?
●   Please read our Paper and...
●   Thanks for your time!

Más contenido relacionado

Was ist angesagt?

OWASP AppSecCali 2015 - Marshalling Pickles
OWASP AppSecCali 2015 - Marshalling PicklesOWASP AppSecCali 2015 - Marshalling Pickles
OWASP AppSecCali 2015 - Marshalling PicklesChristopher Frohoff
 
Node js overview
Node js overviewNode js overview
Node js overviewEyal Vardi
 
Introduction to Storm
Introduction to Storm Introduction to Storm
Introduction to Storm Chandler Huang
 
Redis cluster
Redis clusterRedis cluster
Redis clusteriammutex
 
Secure Code Warrior - Cross site scripting
Secure Code Warrior - Cross site scriptingSecure Code Warrior - Cross site scripting
Secure Code Warrior - Cross site scriptingSecure Code Warrior
 
XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?Yurii Bilyk
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniquesSymantec Security Response
 
Outrageous Performance: RageDB's Experience with the Seastar Framework
Outrageous Performance: RageDB's Experience with the Seastar FrameworkOutrageous Performance: RageDB's Experience with the Seastar Framework
Outrageous Performance: RageDB's Experience with the Seastar FrameworkScyllaDB
 
Exploiting Deserialization Vulnerabilities in Java
Exploiting Deserialization Vulnerabilities in JavaExploiting Deserialization Vulnerabilities in Java
Exploiting Deserialization Vulnerabilities in JavaCODE WHITE GmbH
 
Introduction to memcached
Introduction to memcachedIntroduction to memcached
Introduction to memcachedJurriaan Persyn
 
Polyglot payloads in practice by avlidienbrunn at HackPra
Polyglot payloads in practice by avlidienbrunn at HackPraPolyglot payloads in practice by avlidienbrunn at HackPra
Polyglot payloads in practice by avlidienbrunn at HackPraMathias Karlsson
 
NET Systems Programming Learned the Hard Way.pptx
NET Systems Programming Learned the Hard Way.pptxNET Systems Programming Learned the Hard Way.pptx
NET Systems Programming Learned the Hard Way.pptxpetabridge
 
Build RESTful API Using Express JS
Build RESTful API Using Express JSBuild RESTful API Using Express JS
Build RESTful API Using Express JSCakra Danu Sedayu
 
Securing your AngularJS Application
Securing your AngularJS ApplicationSecuring your AngularJS Application
Securing your AngularJS ApplicationPhilippe De Ryck
 
Introduction to Redis
Introduction to RedisIntroduction to Redis
Introduction to RedisDvir Volk
 
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS FilterX-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS FilterMasato Kinugawa
 
Reverse proxies & Inconsistency
Reverse proxies & InconsistencyReverse proxies & Inconsistency
Reverse proxies & InconsistencyGreenD0g
 
Express JS Middleware Tutorial
Express JS Middleware TutorialExpress JS Middleware Tutorial
Express JS Middleware TutorialSimplilearn
 

Was ist angesagt? (20)

OWASP AppSecCali 2015 - Marshalling Pickles
OWASP AppSecCali 2015 - Marshalling PicklesOWASP AppSecCali 2015 - Marshalling Pickles
OWASP AppSecCali 2015 - Marshalling Pickles
 
Node js overview
Node js overviewNode js overview
Node js overview
 
Introduction to Storm
Introduction to Storm Introduction to Storm
Introduction to Storm
 
Redis cluster
Redis clusterRedis cluster
Redis cluster
 
Secure Code Warrior - Cross site scripting
Secure Code Warrior - Cross site scriptingSecure Code Warrior - Cross site scripting
Secure Code Warrior - Cross site scripting
 
XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
 
Outrageous Performance: RageDB's Experience with the Seastar Framework
Outrageous Performance: RageDB's Experience with the Seastar FrameworkOutrageous Performance: RageDB's Experience with the Seastar Framework
Outrageous Performance: RageDB's Experience with the Seastar Framework
 
Exploiting Deserialization Vulnerabilities in Java
Exploiting Deserialization Vulnerabilities in JavaExploiting Deserialization Vulnerabilities in Java
Exploiting Deserialization Vulnerabilities in Java
 
Introduction to memcached
Introduction to memcachedIntroduction to memcached
Introduction to memcached
 
ZeroNights 2018 | I <"3 XSS
ZeroNights 2018 | I <"3 XSSZeroNights 2018 | I <"3 XSS
ZeroNights 2018 | I <"3 XSS
 
Polyglot payloads in practice by avlidienbrunn at HackPra
Polyglot payloads in practice by avlidienbrunn at HackPraPolyglot payloads in practice by avlidienbrunn at HackPra
Polyglot payloads in practice by avlidienbrunn at HackPra
 
NET Systems Programming Learned the Hard Way.pptx
NET Systems Programming Learned the Hard Way.pptxNET Systems Programming Learned the Hard Way.pptx
NET Systems Programming Learned the Hard Way.pptx
 
Build RESTful API Using Express JS
Build RESTful API Using Express JSBuild RESTful API Using Express JS
Build RESTful API Using Express JS
 
Securing your AngularJS Application
Securing your AngularJS ApplicationSecuring your AngularJS Application
Securing your AngularJS Application
 
Introduction to Redis
Introduction to RedisIntroduction to Redis
Introduction to Redis
 
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS FilterX-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
 
Nodejs vatsal shah
Nodejs vatsal shahNodejs vatsal shah
Nodejs vatsal shah
 
Reverse proxies & Inconsistency
Reverse proxies & InconsistencyReverse proxies & Inconsistency
Reverse proxies & Inconsistency
 
Express JS Middleware Tutorial
Express JS Middleware TutorialExpress JS Middleware Tutorial
Express JS Middleware Tutorial
 

Ähnlich wie Scriptless Attacks - Stealing the Pie without touching the Sill

An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015
An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015
An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015CODE BLUE
 
Security Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemSecurity Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemMartin Vigo
 
MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...
MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...
MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...MMT - Multimediatreff
 
The Future of Web Attacks - CONFidence 2010
The Future of Web Attacks - CONFidence 2010The Future of Web Attacks - CONFidence 2010
The Future of Web Attacks - CONFidence 2010Mario Heiderich
 
Mario heiderich. got your nose! how to steal your precious data without using...
Mario heiderich. got your nose! how to steal your precious data without using...Mario heiderich. got your nose! how to steal your precious data without using...
Mario heiderich. got your nose! how to steal your precious data without using...Yury Chemerkin
 
I thought you were my friend - Malicious Markup
I thought you were my friend - Malicious MarkupI thought you were my friend - Malicious Markup
I thought you were my friend - Malicious MarkupMario Heiderich
 
HTML5 New Features and Resources
HTML5 New Features and ResourcesHTML5 New Features and Resources
HTML5 New Features and ResourcesRon Reiter
 
Sandboxing JS and HTML. A lession Learned
Sandboxing JS and HTML. A lession LearnedSandboxing JS and HTML. A lession Learned
Sandboxing JS and HTML. A lession LearnedMinded Security
 
Passwords good badugly181212-2
Passwords good badugly181212-2Passwords good badugly181212-2
Passwords good badugly181212-2Iftach Ian Amit
 
All Your Password Are Belong To Us
All Your Password Are Belong To UsAll Your Password Are Belong To Us
All Your Password Are Belong To UsCharles Southerland
 
Jinx - Malware 2.0
Jinx - Malware 2.0Jinx - Malware 2.0
Jinx - Malware 2.0Itzik Kotler
 
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)PROIDEA
 
[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜
[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜
[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜Seungmin Shin
 
AWS re:Invent 2016 Fast Forward
AWS re:Invent 2016 Fast ForwardAWS re:Invent 2016 Fast Forward
AWS re:Invent 2016 Fast ForwardShuen-Huei Guan
 
Defcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanningDefcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanningzulla
 
Defcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanningDefcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanningzulla
 
Hacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsHacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsNetsparker
 

Ähnlich wie Scriptless Attacks - Stealing the Pie without touching the Sill (20)

An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015
An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015
An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015
 
How to be a Developer
How to be a DeveloperHow to be a Developer
How to be a Developer
 
Developer &lt; eat love code >
Developer   &lt; eat love code >Developer   &lt; eat love code >
Developer &lt; eat love code >
 
Security Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemSecurity Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against Them
 
MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...
MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...
MMT 29: "Hab Dich!" -- Wie Angreifer ganz ohne JavaScript an Deine wertvollen...
 
The Future of Web Attacks - CONFidence 2010
The Future of Web Attacks - CONFidence 2010The Future of Web Attacks - CONFidence 2010
The Future of Web Attacks - CONFidence 2010
 
Mario heiderich. got your nose! how to steal your precious data without using...
Mario heiderich. got your nose! how to steal your precious data without using...Mario heiderich. got your nose! how to steal your precious data without using...
Mario heiderich. got your nose! how to steal your precious data without using...
 
I thought you were my friend - Malicious Markup
I thought you were my friend - Malicious MarkupI thought you were my friend - Malicious Markup
I thought you were my friend - Malicious Markup
 
HTML5 New Features and Resources
HTML5 New Features and ResourcesHTML5 New Features and Resources
HTML5 New Features and Resources
 
Sandboxing JS and HTML. A lession Learned
Sandboxing JS and HTML. A lession LearnedSandboxing JS and HTML. A lession Learned
Sandboxing JS and HTML. A lession Learned
 
The Rust Programming Language
The Rust Programming LanguageThe Rust Programming Language
The Rust Programming Language
 
Passwords good badugly181212-2
Passwords good badugly181212-2Passwords good badugly181212-2
Passwords good badugly181212-2
 
All Your Password Are Belong To Us
All Your Password Are Belong To UsAll Your Password Are Belong To Us
All Your Password Are Belong To Us
 
Jinx - Malware 2.0
Jinx - Malware 2.0Jinx - Malware 2.0
Jinx - Malware 2.0
 
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
CONFidence 2018: XSS is dead. We just don't get it (Mario Heiderich)
 
[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜
[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜
[KGC 2010] 게임과 보안, 암호 알고리즘과 프로토콜
 
AWS re:Invent 2016 Fast Forward
AWS re:Invent 2016 Fast ForwardAWS re:Invent 2016 Fast Forward
AWS re:Invent 2016 Fast Forward
 
Defcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanningDefcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanning
 
Defcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanningDefcon 20-zulla-improving-web-vulnerability-scanning
Defcon 20-zulla-improving-web-vulnerability-scanning
 
Hacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass FirewallsHacking Vulnerable Websites to Bypass Firewalls
Hacking Vulnerable Websites to Bypass Firewalls
 

Mehr von Mario Heiderich

Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...
Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...
Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...Mario Heiderich
 
JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks
JSMVCOMFG - To sternly look at JavaScript MVC and Templating FrameworksJSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks
JSMVCOMFG - To sternly look at JavaScript MVC and Templating FrameworksMario Heiderich
 
Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...
Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...
Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...Mario Heiderich
 
Dev and Blind - Attacking the weakest Link in IT Security
Dev and Blind - Attacking the weakest Link in IT SecurityDev and Blind - Attacking the weakest Link in IT Security
Dev and Blind - Attacking the weakest Link in IT SecurityMario Heiderich
 
HTML5 - The Good, the Bad, the Ugly
HTML5 - The Good, the Bad, the UglyHTML5 - The Good, the Bad, the Ugly
HTML5 - The Good, the Bad, the UglyMario Heiderich
 
JavaScript From Hell - CONFidence 2.0 2009
JavaScript From Hell - CONFidence 2.0 2009JavaScript From Hell - CONFidence 2.0 2009
JavaScript From Hell - CONFidence 2.0 2009Mario Heiderich
 
The Ultimate IDS Smackdown
The Ultimate IDS SmackdownThe Ultimate IDS Smackdown
The Ultimate IDS SmackdownMario Heiderich
 
I thought you were my friend!
I thought you were my friend!I thought you were my friend!
I thought you were my friend!Mario Heiderich
 
Generic Attack Detection - ph-Neutral 0x7d8
Generic Attack Detection - ph-Neutral 0x7d8Generic Attack Detection - ph-Neutral 0x7d8
Generic Attack Detection - ph-Neutral 0x7d8Mario Heiderich
 

Mehr von Mario Heiderich (10)

Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...
Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...
Copy & Pest - A case-study on the clipboard, blind trust and invisible cross-...
 
JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks
JSMVCOMFG - To sternly look at JavaScript MVC and Templating FrameworksJSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks
JSMVCOMFG - To sternly look at JavaScript MVC and Templating Frameworks
 
Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...
Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...
Locking the Throne Room - How ES5+ might change views on XSS and Client Side ...
 
Dev and Blind - Attacking the weakest Link in IT Security
Dev and Blind - Attacking the weakest Link in IT SecurityDev and Blind - Attacking the weakest Link in IT Security
Dev and Blind - Attacking the weakest Link in IT Security
 
HTML5 - The Good, the Bad, the Ugly
HTML5 - The Good, the Bad, the UglyHTML5 - The Good, the Bad, the Ugly
HTML5 - The Good, the Bad, the Ugly
 
Web Wuermer
Web WuermerWeb Wuermer
Web Wuermer
 
JavaScript From Hell - CONFidence 2.0 2009
JavaScript From Hell - CONFidence 2.0 2009JavaScript From Hell - CONFidence 2.0 2009
JavaScript From Hell - CONFidence 2.0 2009
 
The Ultimate IDS Smackdown
The Ultimate IDS SmackdownThe Ultimate IDS Smackdown
The Ultimate IDS Smackdown
 
I thought you were my friend!
I thought you were my friend!I thought you were my friend!
I thought you were my friend!
 
Generic Attack Detection - ph-Neutral 0x7d8
Generic Attack Detection - ph-Neutral 0x7d8Generic Attack Detection - ph-Neutral 0x7d8
Generic Attack Detection - ph-Neutral 0x7d8
 

Último

How to become a GDSC Lead GDSC MI AOE.pptx
How to become a GDSC Lead GDSC MI AOE.pptxHow to become a GDSC Lead GDSC MI AOE.pptx
How to become a GDSC Lead GDSC MI AOE.pptxKaustubhBhavsar6
 
How to release an Open Source Dataweave Library
How to release an Open Source Dataweave LibraryHow to release an Open Source Dataweave Library
How to release an Open Source Dataweave Libraryshyamraj55
 
From the origin to the future of Open Source model and business
From the origin to the future of  Open Source model and businessFrom the origin to the future of  Open Source model and business
From the origin to the future of Open Source model and businessFrancesco Corti
 
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - TechWebinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - TechProduct School
 
The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)IES VE
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfCheryl Hung
 
Emil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptx
Emil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptxEmil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptx
Emil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptxNeo4j
 
Scenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenariosScenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenariosErol GIRAUDY
 
Q4 2023 Quarterly Investor Presentation - FINAL - v1.pdf
Q4 2023 Quarterly Investor Presentation - FINAL - v1.pdfQ4 2023 Quarterly Investor Presentation - FINAL - v1.pdf
Q4 2023 Quarterly Investor Presentation - FINAL - v1.pdfTejal81
 
UiPath Studio Web workshop Series - Day 3
UiPath Studio Web workshop Series - Day 3UiPath Studio Web workshop Series - Day 3
UiPath Studio Web workshop Series - Day 3DianaGray10
 
Graphene Quantum Dots-Based Composites for Biomedical Applications
Graphene Quantum Dots-Based Composites for  Biomedical ApplicationsGraphene Quantum Dots-Based Composites for  Biomedical Applications
Graphene Quantum Dots-Based Composites for Biomedical Applicationsnooralam814309
 
Keep Your Finger on the Pulse of Your Building's Performance with IES Live
Keep Your Finger on the Pulse of Your Building's Performance with IES LiveKeep Your Finger on the Pulse of Your Building's Performance with IES Live
Keep Your Finger on the Pulse of Your Building's Performance with IES LiveIES VE
 
EMEA What is ThousandEyes? Webinar
EMEA What is ThousandEyes? WebinarEMEA What is ThousandEyes? Webinar
EMEA What is ThousandEyes? WebinarThousandEyes
 
AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024Brian Pichman
 
Stobox 4: Revolutionizing Investment in Real-World Assets Through Tokenization
Stobox 4: Revolutionizing Investment in Real-World Assets Through TokenizationStobox 4: Revolutionizing Investment in Real-World Assets Through Tokenization
Stobox 4: Revolutionizing Investment in Real-World Assets Through TokenizationStobox
 
Patch notes explaining DISARM Version 1.4 update
Patch notes explaining DISARM Version 1.4 updatePatch notes explaining DISARM Version 1.4 update
Patch notes explaining DISARM Version 1.4 updateadam112203
 
Technical SEO for Improved Accessibility WTS FEST
Technical SEO for Improved Accessibility  WTS FESTTechnical SEO for Improved Accessibility  WTS FEST
Technical SEO for Improved Accessibility WTS FESTBillieHyde
 
SIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENT
SIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENTSIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENT
SIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENTxtailishbaloch
 
Introduction - IPLOOK NETWORKS CO., LTD.
Introduction - IPLOOK NETWORKS CO., LTD.Introduction - IPLOOK NETWORKS CO., LTD.
Introduction - IPLOOK NETWORKS CO., LTD.IPLOOK Networks
 
20140402 - Smart house demo kit
20140402 - Smart house demo kit20140402 - Smart house demo kit
20140402 - Smart house demo kitJamie (Taka) Wang
 

Último (20)

How to become a GDSC Lead GDSC MI AOE.pptx
How to become a GDSC Lead GDSC MI AOE.pptxHow to become a GDSC Lead GDSC MI AOE.pptx
How to become a GDSC Lead GDSC MI AOE.pptx
 
How to release an Open Source Dataweave Library
How to release an Open Source Dataweave LibraryHow to release an Open Source Dataweave Library
How to release an Open Source Dataweave Library
 
From the origin to the future of Open Source model and business
From the origin to the future of  Open Source model and businessFrom the origin to the future of  Open Source model and business
From the origin to the future of Open Source model and business
 
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - TechWebinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
 
The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
Emil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptx
Emil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptxEmil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptx
Emil Eifrem at GraphSummit Copenhagen 2024 - The Art of the Possible.pptx
 
Scenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenariosScenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenarios
 
Q4 2023 Quarterly Investor Presentation - FINAL - v1.pdf
Q4 2023 Quarterly Investor Presentation - FINAL - v1.pdfQ4 2023 Quarterly Investor Presentation - FINAL - v1.pdf
Q4 2023 Quarterly Investor Presentation - FINAL - v1.pdf
 
UiPath Studio Web workshop Series - Day 3
UiPath Studio Web workshop Series - Day 3UiPath Studio Web workshop Series - Day 3
UiPath Studio Web workshop Series - Day 3
 
Graphene Quantum Dots-Based Composites for Biomedical Applications
Graphene Quantum Dots-Based Composites for  Biomedical ApplicationsGraphene Quantum Dots-Based Composites for  Biomedical Applications
Graphene Quantum Dots-Based Composites for Biomedical Applications
 
Keep Your Finger on the Pulse of Your Building's Performance with IES Live
Keep Your Finger on the Pulse of Your Building's Performance with IES LiveKeep Your Finger on the Pulse of Your Building's Performance with IES Live
Keep Your Finger on the Pulse of Your Building's Performance with IES Live
 
EMEA What is ThousandEyes? Webinar
EMEA What is ThousandEyes? WebinarEMEA What is ThousandEyes? Webinar
EMEA What is ThousandEyes? Webinar
 
AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024
 
Stobox 4: Revolutionizing Investment in Real-World Assets Through Tokenization
Stobox 4: Revolutionizing Investment in Real-World Assets Through TokenizationStobox 4: Revolutionizing Investment in Real-World Assets Through Tokenization
Stobox 4: Revolutionizing Investment in Real-World Assets Through Tokenization
 
Patch notes explaining DISARM Version 1.4 update
Patch notes explaining DISARM Version 1.4 updatePatch notes explaining DISARM Version 1.4 update
Patch notes explaining DISARM Version 1.4 update
 
Technical SEO for Improved Accessibility WTS FEST
Technical SEO for Improved Accessibility  WTS FESTTechnical SEO for Improved Accessibility  WTS FEST
Technical SEO for Improved Accessibility WTS FEST
 
SIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENT
SIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENTSIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENT
SIM INFORMATION SYSTEM: REVOLUTIONIZING DATA MANAGEMENT
 
Introduction - IPLOOK NETWORKS CO., LTD.
Introduction - IPLOOK NETWORKS CO., LTD.Introduction - IPLOOK NETWORKS CO., LTD.
Introduction - IPLOOK NETWORKS CO., LTD.
 
20140402 - Smart house demo kit
20140402 - Smart house demo kit20140402 - Smart house demo kit
20140402 - Smart house demo kit
 

Scriptless Attacks - Stealing the Pie without touching the Sill

  • 1. Scriptless Attacks Stealing the Pie without touching the Sill Mario Heiderich, Felix Schuster, Marcus Niemietz, Jörg Schwenk, Thorsten Holz ACM CCS 2012 HGI / Chair for Network and Data Security Ruhr-University Bochum mario.heiderich@rub.de || @0x6D6172696F
  • 2. Our Dear Speaker ● Dr.-Ing. Mario Heiderich ● Researcher and Post-Doc, Ruhr-Uni Bochum – PhD Thesis on Client Side Security and Defense ● Founder of Cure53 – Penetration Testing Firm – Consulting – Simply the Best Company of the World ● Published author and international speaker – Specialized in HTML5 and SVG Security – JavaScript, XSS and Client Side Attacks ● HTML5 Security Cheatsheet – @0x6D6172696F – mario@cure53.de
  • 4. Cross Site Scripting ● Lots of talks have been held ● Plenty of research has been done ● Traditional injections ● Attacks from outer space ● XSS, XAS, XDS, XSSQLI, SWXSS, … you name it! ● Defense mechanisms on multiple layers ● Network, Server, Client and what not... – CSP, NoScript, AntiSamy and HTMLPurifier, Tripwires, Browser XSS Filters – mod_security, PHPIDS, some (often nonsense) WAF products ● But why use scripting at all?
  • 5. Topics Today ● Scriptless Attacks in your Browser ● Attacks bypassing NoScript ● Attacks bypassing XSS Filters ● Attacks bypassing Content Security Policy ● Thought Experiment ● What if we defeat XSS? ● What attack surface will remain? ● Will it make a difference?
  • 7. Exploits ● Three Chapters to be presented ● Chapter 1: These simple tricks ● Chapter 2: Advanced Class ● Chapter 3: For Science!
  • 8. Chapter one [ These simple Tricks ]
  • 9. CAPCTHA Of Doom ● Seems legit? ● See it live: http://heideri.ch/opera/captcha/
  • 10. Analysis ● What really happens ● The attacker, Clive, injects CSS... – input[type=password]{content:attr(value)} ● Then he includes a custom SVG font – @font-face {font-family: X;src: url(x.svg#X) format("svg");} ● The attacker simply flips characters – s becomes x, e becomes w, c becomes @ … ● By thinking it's a CAPTCHA... ● … Alice submits her password to the attacker
  • 12. CSS + RegEx = ? ● Old but gold – brute-forcing passwords ● But this time with CSS3 and HTML5 ● The secret ingredient here is „validation“ ● Brute-force with RegEx! ● Let's have a look ● DEMO ● Good thing it works on all browsers ● Limited by smart password managers though
  • 13. Chapter TWO < Advanced Class >
  • 14. SVG Keylogger ● Just a harmless login page ● Behaving strange on closer inspection though... ● Let's check that http://html5sec.org/keylogger
  • 15. How is it done? ● Attacker injected some inline SVG code ● SVG knows the <set> element ● The <set> element can listen to events ● Even keystrokes ● The feature is called accessKey() (W3C) ● JavaScript is turned off – it's „no script“ anyway ● But the keystroke scope is hard to define ● In Firefox it's the whole document
  • 16. CSS + URL + Regex = ? ● More info we can steal ● CSS3 and @document ● Allows to cast a Regex on the loaded URL ● Then deploy custom CSS ● We can steal stuff now ● But we can do even more ;) ● http://html5sec.org/xssfilter/ ● Is that all? ● Maybe not
  • 17. More Madness ● HTML5's dirname attribute ● The most useless attribute ever ● Worse than formaction... which one should know or look up :) ● Meant to tell the server about... *drumroll* ● Text-Flow Direction! ● Also does cruel things to HTTP requests ● DEMO
  • 18. Chapter Three < For Science! >
  • 19. CSRF Tokens ● Everybody knows CSRF ● One domain makes a request to another ● The user is logged into that other domain ● Stuff happens, accounts get modified etc. ● How to we kill CSRF? ● Easily – we use tokens, nonces ● We make sure a request cannot be guessed ● Or brute-forced – good tokens are long and safe
  • 20. CSRF and XSS ● CSRF and XSS are good friends ● JavaScript can read tokens from the DOM ● Bypass most CSRF protection techniques ● But can we steal CSRF tokens w/o JS?
  • 21. Already done ● SDC, Gaz and thornmaker already did it ● Check out http://p42.us/css/ ● They used CSS ● Basically a brute-force via attribute selectors ● input[value^=a]{background:url(?a)} ● If the server catches GET /?a... ● The first character is an a ● But then what? ● There's no „second or Nth character selector“ ● They had to go input[value^=aa]{background:url(?aa)}
  • 22. Ingredients ● Some links with a secret CSRF token ● A CSS injection ● height ● width ● content:attr(href) ● overflow-x:none ● font-family ● And another secret ingredient
  • 23. DEMO ● http://html5sec.org/webkit/test
  • 24. The Magic Part ● The secret ingredients ● Custom SVG font – one per character ● An animation – decreasing the box size ● The overflow to control scrollbar appearance ● And finally... ● Styled scrollbar elements – WebKit only div.s::-webkit-scrollbar-track-piece :vertical:increment {background:red url(/s)}
  • 25. Those Fonts ● There's more we can do with custom fonts ● HTML5 recommends WOFF ● All done via @font-face ● WOFF supports an interesting feature ● Discretionary Ligatures ● Arbitrary character sequences can become one character ● Imagine.. C a t become a cat icon. Or... d e e r a lil' deer
  • 26. Ligatures ● http://ie.microsoft.com/testdrive/graphics/opentype/opentype-monotype/index.html
  • 28. Attack Fonts ● We can thus build dictionary fonts! ● One character per password for example ● No problem for a font to handle 100k+ items ● Map the string s u p e r s e c r e t into one char ● Make everything else invisible ● If the character is visible, we have a hit ● If not the password is not in the list/font ● How can we find out if nothing – or just one character is visible?
  • 29. Go CSS! ● Remember the smart scrollbars? ● Same thing all over again ● But this time for all browsers please ● CSS Media Queries to the rescue! ● We can deploy selective CSS depending on: – Viewport width, viewport height – @media screen and (max-width: 400px){*{foo:bar}} ● Every character gets a distinct width, and/or height ● Once scrollbars appear, the viewport width gets reduced ● By the width of the scrollbar ● Some Iframe tricks do the job and allow universal scrollbar detection ● That's all we need _:D
  • 30. Demo DEMO
  • 31. Conclusion ● Scriptless Attacks versus XSS ● Not many differences in impact ● More common injection scenarios ● Affecting sandboxes with HTML5 ● Information leaks by design ● Hard to detect and fix ● Timing and Side-Channel ● NoScript to the rescue?
  • 32. Defense ● How to protect against features? ● How to protect against side-channels ● Reduce data leakage? ● Build better sandboxes? ● Extend SOP to images and other side channels, ● CSP maybe? One day? ● XFO and Frame-Busters ● Better CSS filter tools are needed! ● Know your spec, contribute!
  • 33. Fin ● Questions? ● Discussion? ● Please read our Paper and... ● Thanks for your time!