Tweet
Tweet

Slide 1

Slide 1 text

Web Platform Security Mike West, Google Chrome @mikewest [email protected] http://bit.ly/wps_techdays_2019

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

Google Vulnerability Reward Program (VRP) payouts in 2018 XSS 35.6% CSRF 3.2% Clickjacking 4.2% Other web bugs 7.8% Non-web issues 49.1% Mobile app vulnerabilities Business logic (authorization) Server /network misconfigurations ...

Slide 5

Slide 5 text

Injections foo.innerHTML = location.hash.slice(1) 1. Logged in user visits attacker's page 2. Attacker navigates user to a vulnerable URL 3. Script runs, attacker gets access to user's session … and many other patterns Bugs: Cross-site scripting (XSS) https://victim.example/?query=

Slide 6

Slide 6 text

Insufficient isolation 1. Logged in user visits attacker's page 2. Attacker sends cross-origin request to vulnerable URL 3. Attacker takes action on behalf of user, or infers information about the user's data in the vulnerable app. Bugs: Cross-site request forgery (CSRF), XS-leaks, timing, ...

Slide 7

Slide 7 text

Insufficient isolation New classes of flaws related to insufficient isolation on the web: - Microarchitectural issues (Spectre / Meltdown) - Advanced web APIs used by attackers - Improved exploitation techniques The number and severity of these flaws is growing.

Slide 8

Slide 8 text

Collaborate in standards bodies

Slide 9

Slide 9 text

https://w3c.github.io/webappsec-csp/ https://csp.withgoogle.com/

Slide 10

Slide 10 text

https://wicg.github.io/trusted-types

Slide 11

Slide 11 text

https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis https://web.dev/samesite-cookies-explained/

Slide 12

Slide 12 text

https://w3c.github.io/webappsec-fetch-metadata

Slide 13

Slide 13 text

https://github.com/whatwg/html/issues/3740

Slide 14

Slide 14 text

https://github.com/whatwg/fetch/issues/687

Slide 15

Slide 15 text

https://www.arturjanc.com/cross-origin-infoleaks.pdf

Slide 16

Slide 16 text

Thanks! Mike West, Google Chrome @mikewest [email protected] http://bit.ly/wps_techdays_2019