Mozilla Observatory First Draft

Luke Crouch For learning and doing web app security

Me Luke Crouch • Privacy & Security Engineer,  Mozilla •
Board member,  Techlahoma Foundation • I’ve had 4 cups of coﬀee already  ☕ ☕ ☕ ☕

This talk • 112 slides in ~15m • Mozilla Observatory
• Website • Command-line tool • API • Questions

How many of you use a tool to scan your
web site or app for security issues? 🙋

In Mozilla research,  16% say Yes n=1,181 web engineers *old
data

In Mozilla research,  47% say No n=1,181 web developers *old
data

Why don’t you use something to scan your web site
or app?

40% say: I don’t need it

Can’t have security vulnerabilities … … if you don’t know
about your security vulnerabilities.

17% say they “need to” use a tool

THANK YOU!

Because even if your app or site may not seem
like a target …

Your users may be re-using their password …

• their bank • their PayPal • their workplace •
their healthcare provider • their password manager (!) • their computer • etc. • their email • which gives an attacker access to all of those others!

So if your app is hacked, their other accounts could
get hacked too.

Next (rhetorical) question …

Which of the following security tech applies to your code?
• Mixed Content • Subresource Integrity • Cross-Origin Resource Sharing • Cookies • Secure • HttpOnly • Content Security Policy • HTTP Strict Transport Security • Redirections • Referrer Policy • X-Frame-Options • X-XSS-Protection • X-Content-Type-Options

🤷🤷

Which of the following security tech applies to your code?
• Mixed Content • Subresource Integrity • Cross-Origin Resource Sharing • Cookies • Secure • HttpOnly • Content Security Policy • HTTP Strict Transport Security • Redirections • Referrer Policy • X-Frame-Options • X-XSS-Protection • X-Content-Type-Options

How do you know what you need to know?

Luke Crouch For learning and doing web app security

Observatory helps me focus on learning the most important security
for my code right now.

Because the reason most of us don’t do all this
… • Mixed Content • Subresource Integrity • Cross-Origin Resource Sharing • Cookies • Secure • HttpOnly • Content Security Policy • HTTP Strict Transport Security • Redirections • Referrer Policy • X-Frame-Options • X-XSS-Protection • X-Content-Type-Options

we don’t have time to do it all.

But, there’s plenty of “quick wins” you can get with
a little bit of time

So, let’s get started …

⚠ Disclaimer: don’t be evil ⚠

You should only use security scanning and testing tools with
permission

So … don’t go scan a bunch of government websites

Now … let’s go scan a bunch of government websites

hackerone.com

So basically, GSA gives permission to scan some sites, within
certain scope and under certain conditions

Let’s try the first one on the list: itdashboard.gov

Loading external scripts over (insecure) HTTP - WCGW? 🤷

https://itdashboard.gov <html> <head> … <script src=“http://ajax.googleapis.com/…”></script> … </head> … </html>

https://itdashboard.gov <script src=“http://ajax.googleapis.com/…”></script> HTTP HTTP

https://itdashboard.gov <html> <head> … <script src=“http://ajax.googleapis.com/…”></script> … </head> … </html>

https://itdashboard.gov <html> <head> <script src=“http://ajax.googleapis.com/…” integrity="sha384-R4/ztc4ZlRqWjqIuvf6RX5yb/v90qNGx6fS48N0tRxiGkqveZETq72KgDVJCp2TC"   > </script> </head>
</html>

https://www.keycdn.com/support/what-is-mime-sniﬃng

https://itdashboard.gov <script src=“/user-uploads/image.jpg”></script> /user-uploads/ js in image.jpg ﬁle js in
image.jpg ﬁle

Does your server set the right Content-Type for scripts and
styles?

This is “easy” - you can add: X-Content-Type-Options: nosniff across
your entire server.

X-Content-Type-Options is the first recommended fix, because it’s easier than
others …

Do you need to support old IE browsers? • No?
• add X-Content-Type-Options: nosniﬀ • Yes? • Sorry to hear that • Does your site need to render user uploads in pages? • No? add X-Content-Type-Options: nosniﬀ • Yes? • Sorry again …

This is how improving your security works

1. Find a potential vulnerability  2. Learn about the potential
attack(s)  3. Determine how much if affects your code specifically  4. Make an appropriate fix  5. Repeat

So, what’s next for itdashboard.gov ?

Normally, you would make the recommended fix …

And then

But since GSA won’t give us access to deploy code
on itdashboard.gov …

Let’s just check out the other tests in the report
…

X-XSS-Protection

But what does it actually do?

https://itdashboard.gov/?param=<script>alert(1)</script> <html> <head><title>…</title></head> <body> <?php echo $_GET[‘param’] ?> </body> </html>

X-XSS-Protection: 1; mode-block

https://itdashboard.gov/?param=<script>alert(1)</script> <html> <head><title>…</title></head> <body> <?php echo $_GET[‘param’] ?> </body> </html>

You might as well take care of older browser users
(they need all they help they can get!)

Do you need to render HTML from url params? •
No? • add X-XSS-Protection: 1; mode-block • Yes? • No you don’t. add X-XSS-Protection: 1; mode-block • For real you do? • No, for real you don’t.

Observatory Command-Line Interface

npm install observatory-cli

observatory itdashboard.gov --zero --format=report

So, same tests and results

Note: no “Recommendation”

But you could put this in your CI pipeline to
scan a dev or stage site on every code change

And you can make CI fail if the score drops
below a certain level

Observatory API

https://github.com/mozilla/http-observatory/blob/master/httpobs/docs/api.md

https://http-observatory.security.mozilla.org/api/v1 • POST /analyze?host=itdashboard.gov • hidden=true&rescan=true • GET /analyze?host=itdashboard.gov •
returns a “scan object” with a scan ID • GET /getScanResults?scan=<scan ID>

Now, let’s scan ALL the GSA sites in scope …

⚠ Disclaimer: don’t be evil ⚠

You should only use security scanning and testing tools with
permission

Questions • Mozilla Observatory • Website • Command-line tool •
API • 3rd-party scans • What else?

Appendix

So, let’s go see where itdashboard.gov might be vulnerable?

View source …

src=“http:// Phrase not found 🤔

“or use protocol-relative URLs” like src=“//

So, if someone accessed this page via insecure http:// ,
we could hack the script

But, if someone accessed this page via insecure http:// ,
we could just hack the page

So when would this ever be a real problem?

When would someone ever access this page over insecure http://
? 🙋

What if someone types “itdashboard.gov” without https?

What if another page links to “itdashboard.gov” without https?

When would someone run this page over insecure http:// ?

When would someone run this page at http://127.0.0.1 ?

Content Security Policy … what’s that?

Insert lots of content about CSP

Mozilla Observatory First Draft

Mozilla Observatory First Draft

More Decks by luke crouch

Other Decks in Technology

Featured

Transcript