Internet Security

Página 1

Threat Model

Different from other threat models

Attacker isn't in control of the network

Attacker hasn't got access to the target's OS

Instead attacker sees messages addressed to themselves or others

Sees data obtained from security compromises

Can make educated guesses

Cookie

Provide persistence as HTTP is stateless protocol

Types- Session- only for 1 browser session / persistent- expire at given time/ secure- only over HTTPS/ HTTPonly- inaccessible from JS

Third party cookies

Associated with the domains that produced them

Some websites include request to other domains- advertisers- these serve lots of cookies

Can track users, 3rd party cookies returned to advertiser every time a site includes one of their ads

Cookie vulnerabilities

How a website uses cookie is up to server

Many create SID to authenticate users- to keep users logged on

Obtaining this cookie- cookie stealing- can hijack their session

Can be stolen simply by monitoring (HTTP)

HTTPS require cross site scripting/ DNS poisoning

SSL/TLS

Dangers associated with sending plain text cookies, passwords etc

SSL/ TLS provide authenticated/ encrypted session

TLS:

Record layer- using established symmetric keys and other session info

Handshake layer- used to establish session keys and authenticate

TLS handshake- allows us to establish the master secret, resume sessions, authenticate the identity of server or client

ClientHello > ServerHello > Certificate > ServerKeyExchange > ClientKeyExchange > ChangeCipherSpec > Finished

TLS Vulnerabilities

Man in middle vulnerbilities are usually countered using public key authentication

Majority of TLS problems are implementation- heartbleed

Protocol downgrade attacks are still a concern

Cross site scripting (XSS)

Similar to SQL injection

Can inject HTML structures into content of a website, browser will simply execute these

Reflected XSS- malicious URL that inserts an exploit directly into page returned by a server

Persistent XSS- no need to trick people into clicking links, any website not sanitising html tags from user input is vulnerable- forums, comments, reviews etc

Preventing- websites must escape HTML characters from any user in/output, find all bizarre obfuscated versions- very tricky

Cross site request forgery (XRSF)

When authenticated after a HTTP request, a malicious URL can perform some malicious action on their account

Use synchroniser tokens to prevent