RIA and Ajax Security Workshop - Web 2.0 Expo Berlin
: Esprimi il tuo voto per questo post- Voto:
(No Ratings Yet)
Loading ... - Publicato:Ottobre 22nd, 2008
- Commenti:No Commenti
- Categoria:web
A very interesting and informative talk dealing with the new types of attacks that affect web 2.0 applications and RIA in particular.
The session was divided in 2 parts, the first about AJAX and the last about Rich Internet Applications.
The slides of this talk are available on slideshare and are impressive for their completeness. Not only they provide detailed examples for every case illustrated, but they link to a series of articles and web resources.
The main problem of this talk is that it’s quite impossible to be able to be specific enough and, at the same time, don’t get too much into details. This resulted in some hard-to-understand parts.
AJAX
In general attacking an AJAX application is more difficult compared to a web 1.0 site. But on the other hand is more difficult to protect an AJAX application because there are more ways to exploit it and new ways are discovered every day.
- Not all “web 2.0″ sites use new technologies (such as Youtube and MySpace)
- A single page in Myspace has a lots of includes.
- Also Google Maps has a lot of includes, but ofJavascript code. Google code can be potentially insecure
Why care about web 2.0 security
- People changed how they interact with web sites (they erase privacy barriers and they don’t feel the distance. The are the new generations)
- Technologies spread from innovators to traditionalists (today AJAX in financial institutions, health care, government) - mainstream
- Bugs are affecting people now
Discovery and method manipulation
- Playing with parameters is still an excellent web attack (asking application to do the work for you). As business logic gets more complex, so do parameters vulnerabilities
- Figuring out web apps is tough part of pen-test
Two types of Ajax apps
- client-server proxy (equivalent to SOAP, client hides javascript)
- client-side rendering (we can see the javascript and know what it does)
Cross Site Scripting
- Downstream communication methods are much more complicated
- User controlled data might be contained in arguments in dynamically created javascript, contained in Javascript arrays, etc. As a result, attack and defence is more difficult
Four bugs
- downstream JS Arrays. Dangerous characters
- XSS payload can be tucked into many places
- XSS might already be in the dom (document.url, document.location, document.referer).
- AJAX uses “backend” requests never expected to be seen directly in browser
RIA
Is ill-defined. Many contain many terms, AJAX, Flash, offline mode, decoupling from the browser. There is a huge disparity in features and security design.
Why use RIA
- to increase responsiveness
- desktop integration
- to write full desktop apps
RIA Frameworks
No one framework is without limits and security problems. The worst seems Adobe Air because it shows all the limits of the very old ActiveX model.
The frameworks:
- Adobe AIR
- Microsoft Silverlight
- Google Gears
- Mozilla Prism
Adobe Air
- Full-featured
- Cross-browser, cross-platform
- Created with Flex, Flash
- Can be invoked by browser with arguments, like ActiveX or Flash
- Air is best thought as ActiveX than Flash ++ (code runs with full privileges and can install malware)
- SWF files can import functionalities that allows them to interact with AIR applications
- SWF files can check install status and version
- By default, code included in AIR application has full rights
- There is not a “code access security” model such as in Java or .Net
- AIR has many ways of loading executable content to run, such as HTML/JS and SWF
- AIR applications can be bundled as binaries
- Problems: allowing users to install signed applets is dangerous. Allowing self-signed is terrifying
- Some suggestions to adobe: change default action, disable unsigned install prompts
Silverlight
Lot of sensibility toward security
- Is the Microsoft Flash equivalent
- Cross browser and cross platform
- Subnet of the .NET frameworks
- The security model is based on .NET
- Calling system primitives the system will fail. You need to isolate it
- What could go wrong (threading, DoS attacks against local system)
Google Gears
- Has SQLite embedded
- Uses an homegrown API for synchronizing data
- Has a LocalServer
- Works offline via SQL database, local assets and a local app server
- Uses some origin to restrict access to site databases and LocalServer resource capture
- Provides for parametrized SQL
- Unfortunately they allows personalization of opt-in screen
Yahoo! Browserplus
- A very bad idea
- Runs as a browser plugin, with a separate helper process
- It’s very similar to ActiveX concepts
- Use old version or Ruby. Perfectly safe as long as you don’t use strings and arrays
Mozilla Prism
- Wraps webapps to appears as desktop apps
- Standalone browser instance
- Problem: the Javascript included with webapps has full XPCOM privileges (but no content scripting privileges)
- Problem: the sandbox isn’t real
HTML 5
HTML introduces some new concepts related to storage of informations.
- Introduces DOM storage (sessionStorage, localStorage, database storage)
- The major goals are more storage space and real persistence, because cookies are considered too small and users delete cookies or won’t accept them
- This method bypasses pesky users, that however can use a specific about:config directive
Browser based SQL Databases
- Injection becomes far more damaging (because of lot of privileges)
Checklist
- prevent predictability named data stores
- parametrize sql statements
Summary
- RIA frameworks widely vary in their security models
- It is highly likely that web developers will introduce interesting flaws into their desktop applications
Interventi correlati
- Opening Welcome - Web 2.0 Expo Berlin
[caption align=”alignleft” width=”300″ caption=”Tim O'Reilly and Yossi Vardi”][/caption] Tim O’Reilly on stage starts a difficult topic: how can web 2.0 help in a world of crisis? Important topic but, in part for the ugly American slang of Tim, in part because he probably had a strong lunch (he’s constantly…
- Ha senso imparare Ajax?
Che in futuro la percentuale di applicazioni web di tipo Ajax (e Ria in generale) aumenti sempre più è un dato di fatto. Ma non è ancora chiaro chi, all’interno del team di sviluppo di un progetto web, debba imparare a masticare questa nuova architettura. Tutti? Solo chi si preoccupa…
- Ajax e l’usabilità
Ho recentemente avuto modo di esprimere qualche pensiero a proposito di Ajax e accessibilità web. Mi però anche chiesto quali siano i vantaggi e gli eventuali problemi legati all’usabilità di questo tipo di applicazioni. Il nocciolo della questione è che varia il modo con cui l’applicazione interagisce con l’utente. Invece…
- Ajax e l’accessibilità dei siti web
(Vedi anche Ajax e l’usabilità) Di Ajax si parla ogni giorno e sono ormai decine i framework per sviluppare applicazioni basate su questo tipo di architettura. Occupandomi da anni di sviluppo web non posso che esserne contento: finalmente i limiti di interfaccia di una pagina possono essere superati! Subito dopo…
- Ajax in action
Il termine Ajax è stato coniato da un anno e non si sono fatti attendere i pesanti manuali che spiegano tutto, ma proprio tutto, su questa architettura. Di Ajax in Action, pubblicato da Manning, ho fondamentalmente apprezzato il modo con cui sono affrontati, fin dalle prime pagine, gli argomenti. Invece…
Link al primo classificato: Siti Genova
Leisa Reichelt
Dopo il successo della BIT di Milano, dove abbiamo fatto conoscenza con moltissimi lettori di Booking Blog, speriamo di poterci di nuovo incontrare a Rimini dal 24 al 26 Ottobre 2008 in occasione del “TTG Incontri”, una delle più importanti fiere per l’industria del turismo, e un’occasione unica per conoscere in anticipo le novità del mercato.
Nel ristorante del vostro hotel, quante volte pensate di aver superato le aspettative dei clienti? Qualche volta? Raramente? Mai? Quante volte avete cenato personalmente in un ristorante che abbia superato le vostre aspettative?
Il primo ottobre, una corte di Madrid si è pronunciata a favore del sito di viaggi spagnolo Rumbo che 2 mesi prima aveva presentato un’ingiunzione per impedire a Ryanair di accettare prenotazioni solo da www.ryanair.com.
Nel corso dell’
Uno degli aspetti più difficili del marketing di un hotel è trovare i giusti target. Possiamo cercare di accontentare tutti: famiglie, single, giovani, anziani, coppie, gruppi…ma la possibilità di successo aumenta drasticamente quando l’offerta dell’hotel si rivolge ad un gruppo specifico. Se progettiamo il sito per accontentare tutti, probabilmente non accontenteremo nessuno.
