Basics

Web Today

  • Purpose of the Web:
    • Link plain text documents
    • (Transfer textual data between computers)
  • Highly-developed application platform
    • e.g., mobile applications, office applications
    • Based on multi-origin documents
    • Origin-based security models (e.g., SOP, CORS)
    • UI support (HTML, CSS, JS)
    • Support of offline applications with client-side persistence
  • Reason for security issues:
    • Web uses non-security mechanisms for security purpose
    • e.g., Cookies for Authentication
    • Interpret data as code (injection attacks)
  • Peak of web vulnerabilities
    • 2006: 6600 total
    • 2014: 8000 total
    • 2018: 16000 total
    • Most common:
      • Code Execution (3000 in 2018)
      • XSS (2000 in 2018)
  • Possible attack-surface
    • Integrated third-party code on server
    • Integrated third-party code on website
      • UI (Google Maps)
      • Frameworks (Angular)
      • Cross-domain JS library (jQuery)
    • Third-party authentication providers (e.g., Google, GitHub)
    • Secondary view on application (e.g., mobile devices)
    • Network communication

History

  • 1945
    • First mention of hypertext: Plain texts with links between them
  • 1980
    • Tim Berners-Lee developed ENQUIRE (hypertext program at CERN)
  • 1989
    • Tim Berners-Lee wrote the paper “Information Management” (basis for the modern web)
  • 1991
    • HTTP/HTML invented by Berners-Lee
      • Document-centric format
      • Stateless
    • HTTP 0.9
    • HTML had 18 tags
  • 1992
    • HTTP 1.0 (adding headers)
  • 1993
    • Mosaic (first) browser supports inline images from remove server
      • Multi-origin web was born
    • Common Gateway Interface (CGI)
      • First Web Application
      • Pass HTTP request to scripts (Parameter via URL)
      • HTTP Response written to stdout
    • HTTP Authentication
      • HTTP Authentication header added (no session management)
      • Lead to first security considerations
  • 1994
    • Cookies added by Netscape navigator (HTTP Response header)
  • 1995
    • JavaScript invented by Netscape navigator
      • Scheme (programming language) in a browser
      • Idea: Java for browser
    • Frames invented
      • Lead to XSS and Same-Origin Policy
    • Internet Explorer published
  • 1996
    • Cascading Style Sheets invented
      • Separate structure and presentation
      • Declarative syntax
  • 1996-1999
    • The First Browser War
      • Netscape vs. Internet Explorer
      • Race for compatibility (parse bad HTML)
      • Microsoft wins
  • 1999:
    • HTTP 1.1
  • 2000-2003
    • Stagnation of Internet Explorer (few updates)
    • Flash added to get new features
  • 2003
    • Apple Safari (using WebKit) introduced
  • 2004
    • Mozilla Firefox introduced
    • Apple Safari introduced
    • WHATWG introduced (Web Hypertext Application Technology Working Group)
      • Members from Apple, Mozilla, Opera
      • Specified HTML5
      • Innovation for browsers
  • 2004-2005
    • The Web 2.0
      • New functionality
      • AJAX (lead to Facebook, GMail, …)
  • Since 2005
    • The Second Browser War (IE, Chrome, Firefox, Safari)
    • Focus on speed (not compatibility)
    • Fasted engine: WebKit (Chrome + Safari)
  • 2014
    • HTML5 final specification

HTML5 Features

  • Audio/video tags
  • Web Storage API (Key-value-storage, Session and Local storage)
  • Web Messaging
  • Web Sockets (duplex communication)
  • Offline Cache (enable offline apps)
  • Web Workers (multi-tasking)
  • Geo Location
  • Semantic tags (e.g., nav, footer, header)

Attackers

Network Attacker

  • Attack communication link (client-server)
  • Goal: Disturb confidentiality, integrity and authenticity of connection
  • Capabilities (CRUD)
    • Traffic observation (passive eavesdropper)
    • Traffic fabrication (fake package injection)
    • Traffic disruption (drop packages)
    • Traffic modification (change un-encrypted packages)
  • Man-in-the-middle
  • Types:
    • Same network (e.g., ARP poisoning)
    • Internet Service Provider (i.e., access to all traffic)
    • Law Enforcement (e.g., specific access)
    • Security services
  • Network attackers on the Web
    • Active (e.g., add advertisement into unencrypted sites)
    • Passive (eavesdrop information, e.g., credentials)

Remote Attacker

  • Attack remote system (e.g., server)
  • Goal: Compromise the system
    • Code execution
    • Information exfiltration (e.g., SQL Injection)
    • Information modification
    • Denial of Service

Web Attacker

  • Attack certain web application
  • Man-in-the-browser
    • Create HTTP requests
    • Leverage user’s state
    • Confused deputy (misuse browser privileges)
  • Cross-site scripting attacker (misuse trust of browser)
  • Cross-site request forgery attacker (misuse trust of remote server)

Social Engineering Attacker

  • No technical capabilities but technical knowledge
  • Trick user to perform certain tasks
  • Attacks:
    • Phishing (e.g., fake login form)
    • Click Jacking (e.g., overlay site)
  • Tricks:
    • Fake unicode URLs
    • Use well-known icons to suggest “security”

Uniform Resource Locator (URL)

  • Scheme to identify and locate resources
  • Structure
    • Protocol (e.g., http)
    • User/Passwort (e.g., foo:bar)
    • Hostname (e.g., example.org)
    • Port (e.g., 80)
    • Path (e.g., /doc.html)
    • Query (v=1)
    • Fragment (frag, not send to server)
  • Example: http://foo:bar@example.org:80/doc.html?v=1&w=2#frag
  • Scheme: <protocol>://[user][@pass]<hostname>[:<port>]<path>[?<query>][#<fragment>]

HTTP

  • HyperText Transfer Protocol
  • Purpose: Represent structure of a document
  • Properties
    • Stateless protocol (single request/single response)
    • No notion of sessions
    • Human readable/writeable (until HTTP/2.0)
    • Based on TCP (+TLS)

Request

  • Structure
    • Request line (Verb, Path, Protocol)
      • e.g., GET /index.html HTTP/1.0
    • Headers (header:value)
      • e.g., Host: www.example.org
      • e.g., Cookie: foo=bar
      • Ends with newline
    • Optional body message (e.g., for POST requests)
  • Host-header added in HTTP 1.1
  • Method GET
    • Purpose: Retrieve resource
    • No body message
    • Should be stateless (idempotent, no state change on server)
    • Pass parameters via URL
    • Attack: HTTP Parameter pollution
  • Method POST
    • Purpose: Send data to server
      • Storage/processing
      • Use for state-changing operations
    • Can be combined with GET parameters
    • Contains body (URL-encoded data)
    • Attack: HTTP Response Splitting
  • Verbs
    • HEAD (GET with headers only)
    • PUT/DELETE/PATCH (resource management, WebDAV, REST)
    • OPTIONS (query communication options)
    • CONNECT (for proxies)
    • TRACE (trace message, server returns message as received)

Response

  • Structure
    • Status line (Protocol, Status Code, Status Text)
      • e.g., HTTP/1.1 200 OK
    • Headers
      • e.g., Server: Apache
      • Ends with newline
    • Response body
  • Status Code
    • 1xx Information
    • 2xx Success
      • 200 OK
      • 206 Partial Content
    • 3xx Redirect
      • 301 Moved Permanently
      • 304 Not Modified
      • 307 Moved Temporarily
    • 4xx Client errors
      • 400 Bad Request
      • 401 Unauthorized
      • 403 Forbidded
      • 404 Not Found
      • 410 Gone
      • 418 I’m a teapot
    • 5xx Server errors
      • 500 Internal Server Error
  • Possibility to provide security information to client
    • e.g., CSP and CORS

Versions

  • HTTP 0.9
    • Requirements: Serve single HTML pages
    • Result:
      • Only GET
      • No headers
      • Sever answers with HTML body
  • HTTP 1.0
    • 1991-1995
    • Requirements:
      • Authentication
      • Meta data transmission
      • Transmit data to server
      • Serve binary data
    • Result:
      • Request: HTTP version must be set
      • Optional headers (request + response)
      • Response: Status line
      • New methods: POST + HEAD
  • HTTP 1.1
    • 1999
    • Requirements:
      • New transport/caching strategies (larger resources)
      • Assess server’s capabilities
    • Result:
      • New methods: PUT/DELETE/TRACE/CONNECT/OPTIONS
      • Keep-Alive connections
      • Accept-Encoding for server (sent by client)
      • Chunk transfer
      • Standardized in RFC 2616
  • HTTPS
    • 1999 (RFC 2818)
    • S-HTTP: Unencrypted header, encrypted body
    • Encapsulate HTTP in TLS tunnel (HTTPS)
    • Chain of trust by certificates
    • Server Name Identification (SNI):
      • Multiple hosts via TLS (since 2011)
  • HTTP 2.0
    • 2015
    • Requirements
      • Reduce overhead of uncompressed HTTP headers
      • Fast delivery of resources to client
      • Fix head-of-line blocking
    • Result
      • Binary protocol
      • Server push
      • Header compression
    • Further reading: Introduction to HTTP/2