## Cross-Domain Communication
- Focus: Cross-domain Network Communication
- Problem:
	- XMLHttpRequest initially used the SOP 
	- SOP often too restrictive for this use case
	- e.g., authentication backend at a different origin, data on different servers
- How to perform cross-domain requests?
	- Adobe Flash
	- JSONP
	- Cross-Origin Resource Sharing (see *Policies*)

#### Adobe Flash
- Allows cross-domain communication
- Includes all cookies for requests
- Flash does not inherit origin
	- e.g., Flash from `a.com` can create requests to `a.com` (with cookies) if included on `b.com`
- Remote server must allow communication
	- Only for remotes with other origins (not the Flash-providing origin)
	- List of allowed hosts
	- Config file: `crossdomain.xml`
	- First, config file is fetched from remote server
- 2016: Used by 8 % of sites

![](images/03-flash.png)
#### JSONP
- *JSON with Padding*
- Use Case:
	- Script wants to load resource from remote host (e.g., JSON data)
- Problem:
	- SOP prohibits *reading* resources from other origins
	- Idea: *Embed* external resource (allowed by SOP)
	- Loading JSON in `<script>` tag is allowed but not accessible to other scripts in the browser
- Solution:
	- Wrap JSON data in function call (also called *padding*)
	- Script is executed in including scope
- Example:
	- Site: `<script src="example.org/resource.json?callback=myfunc"/>`
	- Server-Response: `myfunc(<data>)`

##### Functionality
- Remote server wraps JSON data in function
	- Alternative: Create global variable
- Function must be defined in browser scope/client side
- Function name is supplied as GET parameter in URL
- *Script element injection*: Add `<script>` element to request the JSONP-data
- Example:
	- Request: `example.org/user.json?callback=func`
	- Response: `func({...})`

##### Disadvantages
- Dirty hack
- Remote server: Hard to ensure that allowed clients can access data
	- e.g., Referer header can be stripped (by using `data:` URLs)
- Execute remote script (Attacker can change response/inject code)
- Remote server can compromise requesting client

##### Rosetta Flash Attack
- **Combination of JSONP and Flash**
- Attack scenario:
	- Attacker wants to steal sensitive information from a vulnerable target site (e.g., Google)
	- Target site provides JSONP interface
	- Attacker controls some web-server
	- Attacker embeds a call to the JSONP interface of the vulnerable target site in his web server
- Attack:
	- JSONP callback contains malicious Flash file which extracts sensitive information from the user account of the victim
	- The Flash file can send cookie-carrying requests to the target site (because the Flash comes from there)
- Vulnerability:
	- JSONP allows the attacker to control first bytes (callback)
	- JSONP only allows printable characters as callback
	- Attacker sets callback to malicious Flash file (using Huffman encoding and zlib)
	- Attacker includes this callback in his website (request JSONP interface of target site)
	- Victim's browser accessing attacker's website creates JSONP request and executes this received Flash
	- Problem: Flash does not inherit origin, so victim's browser can send requests with cookies to target website and exfiltrate sensitive information
- e.g., using `<object type="application/flash"...>`
- More Information: [Blog entry](https://blog.miki.it/2014/7/8/abusing-jsonp-with-rosetta-flash/)