An intro to web security

Slide 1

Slide 1 text

An intro to web security Florencia Herra Vega CTO, Peerio

Slide 2

Slide 2 text

An intro to web in/security 1. Some structural things about the web (with focus on DNS) 2. Some pranks/tools 3. How HTTPS helps 4. Using Let’s Encrypt

Slide 3

Slide 3 text

Why is the internet so insecure? • Security is not built in

Slide 4

Slide 4 text

Why is the internet so insecure? • Security is not built in • Data sent in the open

Slide 5

Slide 5 text

Why is the internet so insecure? • Security is not built in • Data sent in the open • Huge and unmaintained

Slide 6

Slide 6 text

Why is it hard to learn? • High level of abstraction in development

Slide 7

Slide 7 text

Why is it hard to learn? • High level of abstraction in development • The foundations are ugly.

Slide 8

Slide 8 text

Why is it hard to learn? • High level of abstraction in development • The foundations are ugly. • Security requires the foundations.

Slide 9

Slide 9 text

What happens when you request a webpage in your browser? show me that blog text! images!

Slide 10

Slide 10 text

What happens when you request a webpage in your browser?

Slide 11

Slide 11 text

http://harryblogs.potter-weasley-family.com

Slide 12

Slide 12 text

What happens when you request a webpage in your browser?

Slide 13

Slide 13 text

What happens when you request a webpage in your browser?

Slide 14

Slide 14 text

What happens when you request a webpage in your browser? hosting ISP ?

Slide 15

Slide 15 text

What happens when you request a webpage in your browser? hosting ISP

Slide 16

Slide 16 text

http://harryblogs.potter-weasley-family.com

Slide 17

Slide 17 text

http://harryblogs.potter-weasley-family.com where do I ﬁnd blog?

Slide 18

Slide 18 text

http://harryblogs.potter-weasley-family.com ok this is an address 159.203.37.70

Slide 19

Slide 19 text

Domain Name System (DNS)

Slide 20

Slide 20 text

Domain Name System (DNS) The address book of the internetz.

Slide 21

Slide 21 text

Domain Name System (DNS) The recursive address books of the internetz.

Slide 22

Slide 22 text

DNS hey browser, do you know about harryblogs.potter-weasley-family.com? nope

Slide 23

Slide 23 text

DNS hey OS, do you know about harryblogs.potter- weasley-family.com? nope

Slide 24

Slide 24 text

DNS hey router, do you know about harryblogs.potter- weasley-family.com? nope

Slide 25

Slide 25 text

DNS hey ISP, do you know about harryblogs.potter- weasley-family.com? nope

Slide 26

Slide 26 text

DNS hey root DNS server, do you know about harryblogs.potter-weasley-family.com? nope, but I know about .com go ask the .com TLD DNS server

Slide 27

Slide 27 text

DNS hey .com DNS server, do you know about harryblogs.potter-weasley-family.com? nope, but I know where the name servers for potter-weasley-family.com are! ns1.diagonalhosting.com

Slide 28

Slide 28 text

DNS hey ns1.diagonalhosting.com, do you know about harryblogs.potter-weasley-family.com? YES 159.203.37.70

Slide 29

Slide 29 text

DNS hey ns1.diagonalhosting.com, do you know about harryblogs.potter-weasley-family.com? YES 159.203.37.70 AUTHORITATIVE

Slide 30

Slide 30 text

browser OS router ISP authoritative nameserver ﬁnd!

Slide 31

Slide 31 text

browser OS router ISP authoritative nameserver ﬁnd! cache for n seconds! cache for n seconds! cache for n seconds! cache for n seconds!

Slide 32

Slide 32 text

DNS hey ISP, do you know about harryblogs.potter- weasley-family.com? YES 159.203.37.70

Slide 33

Slide 33 text

Okay, now we know who to talk to. "

Slide 34

Slide 34 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 35

Slide 35 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 36

Slide 36 text

TCP “polite request to chat” Hey buddy can I talk to you for a second? SYN Me? You wanna talk to me? SYN/ACK Yes you! ACK

Slide 37

Slide 37 text

HTTP GET / HTTP/1.1 Host: harryblogs.potter-weasley-family.com

Slide 38

Slide 38 text

HTTP GET / HTTP/1.1 Host: harryblogs.potter-weasley-family.com HTTP/1.1 200 OK Harry’s blog This is a blog.

Slide 39

Slide 39 text

Let’s see it all in action. # Wireshark!

Slide 40

Slide 40 text

buy this thing! one weird trick wow wow Entrepreneur piverate integrate grok Steve Jobs innovate big data experiential. Minimum viable product 360 campaign ship it grok responsive ship it co-working iterate. Sticky note viral ideate user centered design agile unicorn 360 campaign workﬂow hacker earned media parallax viral. Personas personas Steve Jobs quantitative vs. qualitative moleskine convergence pitch deck experiential co-working responsive responsive pair programming thought leader personas. Disrupt entrepreneur personas fund minimum viable product driven sticky note convergence viral quantitative vs. qualitative. Sticky note affordances responsive parallax prototype thought leader bootstrapping pivot. Like this! Tweet this! You’ll never believe these animal pix! This comments section won’t offend you…. Boring text but there is a Youtube video below! buy my merch! Patreon GitTip Flattr Bitcoin

Slide 41

Slide 41 text

External content • Ads • JS/CSS CDNs • Image/video hosting CDNs • Analytics like Google Analytics/Mixpanel • Social media counters • Social media buttons • E-commerce buttons (Flattr, Patreon, PayPal)

Slide 42

Slide 42 text

Let’s try to break it.

Slide 43

Slide 43 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 44

Slide 44 text

[A quick and dirty DNS prank] /etc/hosts

Slide 45

Slide 45 text

Some DNS only resolves locally.

Slide 46

Slide 46 text

browser OS router ISP authoritative nameserver ﬁnd! insert records

Slide 47

Slide 47 text

browser OS router ISP authoritative nameserver ﬁnd! cache poisoning x cache for n seconds! cache for n seconds! cache for n seconds!

Slide 48

Slide 48 text

Problems • I can see what you’re saying • I can see your passwords • I can fool you into accessing the wrong website through DNS • I can fool you into accessing the wrong website a bunch of other ways too

Slide 49

Slide 49 text

Solutions?

Slide 50

Slide 50 text

HTTP HTTP/1.1 200 OK Super secret info about the anti- Death Eater rally!

Slide 51

Slide 51 text

HTTP :( not so secret now HTTP/1.1 200 OK Super secret info about the anti- Death Eater rally! Voldemort-in-the-middle

Slide 52

Slide 52 text

HTTPS wow ? AmfhZQFJ6lBRRWWRyHfOwmLnF4Zi7 HafGjXMfDdvm2KRd3qXhxOoeTP9vy ddrZ05o4PkE86q54ySQOJA6UwwHt0 NxQ+0RO0/ DnRbbPs1phgVX6wrZ93PVRLP xxHPwNBOQZg0qcxvEcl2fixs/ OtxhEHNfhlB

Slide 53

Slide 53 text

HTTPS not so wow AmfhZQFJ6lBRRWWRyHfOwmLnF4Zi7 HafGjXMfDdvm2KRd3qXhxOoeTP9vy ddrZ05o4PkE86q54ySQOJA6UwwHt0 NxQ+0RO0/ DnRbbPs1phgVX6wrZ93PVRLP xxHPwNBOQZg0qcxvEcl2fixs/ OtxhEHNfhlB dns wizardry

Slide 54

Slide 54 text

HTTPS not so wow the rally is at this TOTALLY INCORRECT place dns wizardry

Slide 55

Slide 55 text

HTTPS not so wow I want to join Dumbledore’s Army and this is my name, address, bank account, and other unnecessarily personal info.

Slide 56

Slide 56 text

HTTPS not so wow I want to join Dumbledore’s Army and this is my name, address, bank account, and other unnecessarily personal info. I want to join Dumbledore’s Army and this is my name, address, bank account, and other unnecessarily personal info.

Slide 57

Slide 57 text

Encryption keys are unique!

Slide 58

Slide 58 text

Certiﬁcate: public key + metadata!

Slide 59

Slide 59 text

Signed Certiﬁcates

Slide 60

Slide 60 text

Signed Certiﬁcates

Slide 61

Slide 61 text

Chain of trust

Slide 62

Slide 62 text

Chain of trust Root certiﬁcate authority certiﬁcates are installed on your computer/ phone/browser.

Slide 63

Slide 63 text

Hello, I’d like to talk to Harry’s blog securely Yes this is Harry’s blog, v secure! Hold up, why should I trust that you’re actually Harry? Because Diagon Alley Hosting says so. Hey Diagon Alley Hosting, do you know this guy? Yes, we can vouch for him. But how do I know who you are? Look me up with Gringotts Identities.

Slide 64

Slide 64 text

[Let’s mess with DNS again.]

Slide 65

Slide 65 text

Why should I use HTTPS on my websites? • Protects your users from snooping. • Will raise hell if someone pretends to be you.

Slide 66

Slide 66 text

Why doesn’t everybody do this? • Money. • Pain.

Slide 67

Slide 67 text

Why doesn’t everybody do this? • Money. • Pain. Bureaucracy + encryption = not cute.

Slide 68

Slide 68 text

Let’s encrypt! The easiest way to set up HTTPS with Apache ever…

Slide 69

Slide 69 text

Let’s Encrypt! • nginx https://www.digitalocean.com/community/ tutorials/how-to-secure-nginx-with-let-s-encrypt-on- ubuntu-14-04 • apache https://www.digitalocean.com/community/ tutorials/how-to-secure-apache-with-let-s-encrypt- on-ubuntu-14-04

Slide 70

Slide 70 text

No content

Slide 71

Slide 71 text

Shared hosting providers that support Let’s Encrypt https://github.com/letsencrypt/letsencrypt/wiki/Web- Hosting-Supporting-LE

Slide 72

Slide 72 text

What can I do as a user? • HTTPS everywhere browser extension • https://chrome.google.com/webstore/detail/https-everywhere/ gcbommkclmclpchllfjekcdonpmejbdp?hl=en • https://addons.mozilla.org/en-US/ﬁrefox/addon/https-everywhere/ • Ad and tracker blocking • https://chrome.google.com/webstore/detail/ublock-origin/ cjpalhdlnbpaﬁamejdnhcphjbkeiagm?hl=en • https://www.eff.org/privacybadger

Slide 73

Slide 73 text

More resources • “Server Farm to Table” — http://jenna.is/server-farm-to- table-annotated.pdf • Computerphile “Man in the Middle attacks” — https:// www.youtube.com/watch?v=-enHfpHMBo4 • Computerphile “Public key cryptography” — https:// www.youtube.com/watch?v=GSIDS_lvRv4 • “Cat DNS” — https://www.youtube.com/watch? v=qDPhW9P44fI • Wireshark — https://www.wireshark.org/