At hack.lu, the best talk so far is Nitesh Dhanjani's talk Breaking and Securing Web applications.
Random notes below the fold.
- cross-site scripting is an output validation problem
- analysis tools are insufficient
- hard to understand, hard to demonstrate ("alert" doesn't cut it); but see beef for a nice tool
- If XSS vectors go through databases, particularly hard to find.
- XSRF - confused deputy problem (but uses <img src="...>, i.e., HTTP GET, as example)
- Yahoo! mobile as example
- POST-based example for Yahoo! calendar, through JavaScript
- Mitigation
- Do not rely on referer header
- do not rely on POST
- use random tokens
- should there be client-side protection? - well...
- How do you assess XSRF? -- hard to distinguish important / unimportant operations
- XSRF can be used by external attacker to turn browser into proxy to Intranet
- Combine XSS and XSRF?
- Targeting the Browser?
- Flash crossdomain issue --
crossdomain.xmlcan now exist anywhere in the web root - application access control model?
- Cross-domain requests in Flash: Look for cross-domain.xml in root of target site.
- recent change:
crossdomain.xmlcan sit about anywhere - consider if we have an upload/download area
- extremely difficult for application owners
- use XSS to drop crossdomain.xml in there ... whooops?
- Remember Adobe's PDF plugin? (javascript in fragment identifiers) It's a purely client-side issue.
- application security will continue to be extremely important
Comments (2)
Posted by Benny K | October 20, 2007 12:57 PM
Posted on October 20, 2007 12:57
Posted by tlr | October 20, 2007 1:05 PM
Posted on October 20, 2007 13:05