Intro to web security - Speaker Deck

Slide 1

Slide 1 text

An intro to web security Florencia Herra Vega CTO, Peerio

Slide 2

Slide 2 text

An intro to web in/security 1. Some structural things about the web (with focus on DNS) 2. Some ways the web breaks 3. How HTTPS helps

Slide 3

Slide 3 text

Why is the internet so insecure? • Security is not built in

Slide 4

Slide 4 text

Why is the internet so insecure? • Security is not built in • Data sent in the open

Slide 5

Slide 5 text

Why is the internet so insecure? • Security is not built in • Data sent in the open • Huge and unmaintained

Slide 6

Slide 6 text

Why is it hard to learn? • High level of abstraction in development

Slide 7

Slide 7 text

Why is it hard to learn? • High level of abstraction in development • The foundations are ugly.

Slide 8

Slide 8 text

Why is it hard to learn? • High level of abstraction in development • The foundations are ugly. • Security requires the foundations.

Slide 9

Slide 9 text

Why is it hard to learn? • High level of abstraction in development • The foundations are ugly. • Security requires the foundations. • The illusion of state

Slide 10

Slide 10 text

What happens when you request a webpage in your browser? show me that blog text! images!

Slide 11

Slide 11 text

What happens when you request a webpage in your browser? log in! special text! racy images!

Slide 12

Slide 12 text

What happens when you request a webpage in your browser?

Slide 13

Slide 13 text

http://harryblogs.potter-weasley-family.com

Slide 14

Slide 14 text

What happens when you request a webpage in your browser?

Slide 15

Slide 15 text

What happens when you request a webpage in your browser?

Slide 16

Slide 16 text

What happens when you request a webpage in your browser? hosting ISP ?

Slide 17

Slide 17 text

What happens when you request a webpage in your browser? hosting ISP

Slide 18

Slide 18 text

http://harryblogs.potter-weasley-family.com

Slide 19

Slide 19 text

http://harryblogs.potter-weasley-family.com where do I ﬁnd blog?

Slide 20

Slide 20 text

159.203.37.70 149.102.21.10

Slide 21

Slide 21 text

Domain Name System (DNS)

Slide 22

Slide 22 text

Domain Name System (DNS) The address book of the internetz.

Slide 23

Slide 23 text

Domain Name System (DNS) The recursive address books of the internetz.

Slide 24

Slide 24 text

DNS hey browser, do you know about harryblogs.potter-weasley-family.com? nope

Slide 25

Slide 25 text

DNS hey OS, do you know about harryblogs.potter- weasley-family.com? nope

Slide 26

Slide 26 text

DNS hey router, do you know about harryblogs.potter- weasley-family.com? nope

Slide 27

Slide 27 text

DNS hey ISP, do you know about harryblogs.potter- weasley-family.com? nope

Slide 28

Slide 28 text

DNS hey root DNS server, do you know about harryblogs.potter-weasley-family.com? nope, but I know about .com go ask the .com TLD DNS server

Slide 29

Slide 29 text

DNS hey .com DNS server, do you know about harryblogs.potter-weasley-family.com? nope, but I know where the name servers for potter-weasley-family.com are! ns1.diagonalhosting.com

Slide 30

Slide 30 text

DNS hey ns1.diagonalhosting.com, do you know about harryblogs.potter-weasley-family.com? YES 159.203.37.70

Slide 31

Slide 31 text

DNS hey ns1.diagonalhosting.com, do you know about harryblogs.potter-weasley-family.com? YES 159.203.37.70 AUTHORITATIVE

Slide 32

Slide 32 text

browser OS router ISP authoritative nameserver ﬁnd!

Slide 33

Slide 33 text

browser OS router ISP authoritative nameserver ﬁnd! cache for n seconds! cache for n seconds! cache for n seconds! cache for n seconds!

Slide 34

Slide 34 text

DNS hey ISP, do you know about harryblogs.potter- weasley-family.com? YES 159.203.37.70

Slide 35

Slide 35 text

Okay, now we know who to talk to. #

Slide 36

Slide 36 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 37

Slide 37 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 38

Slide 38 text

TCP “polite request to chat” Hey buddy can I talk to you for a second? SYN Me? You wanna talk to me? SYN/ACK Yes you! ACK

Slide 39

Slide 39 text

HTTP GET / HTTP/1.1 Host: harryblogs.potter-weasley-family.com

Slide 40

Slide 40 text

HTTP GET / HTTP/1.1 Host: harryblogs.potter-weasley-family.com HTTP/1.1 200 OK Harry’s blog This is a blog.

Slide 41

Slide 41 text

buy this thing! one weird trick wow wow Entrepreneur piverate integrate grok Steve Jobs innovate big data experiential. Minimum viable product 360 campaign ship it grok responsive ship it co-working iterate. Sticky note viral ideate user centered design agile unicorn 360 campaign workﬂow hacker earned media parallax viral. Personas personas Steve Jobs quantitative vs. qualitative moleskine convergence pitch deck experiential co-working responsive responsive pair programming thought leader personas. Disrupt entrepreneur personas fund minimum viable product driven sticky note convergence viral quantitative vs. qualitative. Sticky note affordances responsive parallax prototype thought leader bootstrapping pivot. Like this! Tweet this! You’ll never believe these animal pix! This comments section won’t offend you…. Boring text but there is a Youtube video below! buy my merch! Patreon GitTip Flattr Bitcoin

Slide 42

Slide 42 text

External content • Ads • JS/CSS CDNs • Image/video hosting CDNs • Analytics like Google Analytics/Mixpanel • Social media counters • Social media buttons • E-commerce buttons (Flattr, Patreon, PayPal)

Slide 43

Slide 43 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 44

Slide 44 text

Insurance Company Inc. ISP Inc. 159.203.37.70 I see you.

Slide 45

Slide 45 text

How can we break this perfectly simple and logical system?

Slide 46

Slide 46 text

Insurance Company Inc. ISP Inc. 159.203.37.70

Slide 47

Slide 47 text

A simple prank vi /etc/hosts 104.16.126.167 your-friends-favourite-blog.com

Slide 48

Slide 48 text

A simple prank vi /etc/hosts

Slide 49

Slide 49 text

A simple prank vi /etc/hosts 104.16.126.167 your-friends-favourite-blog.com

Slide 50

Slide 50 text

browser OS router ISP authoritative nameserver ﬁnd! insert records

Slide 51

Slide 51 text

Some DNS only resolves locally.

Slide 52

Slide 52 text

browser OS router ISP authoritative nameserver ﬁnd! cache poisoning x cache for n seconds! cache for n seconds! cache for n seconds!

Slide 53

Slide 53 text

Problems • I can see what you’re saying • I can see your passwords • I can fool you into accessing the wrong website through DNS • I can fool you into accessing the wrong website a bunch of other ways too

Slide 54

Slide 54 text

“Voldemort in the middle”

Slide 55

Slide 55 text

HTTP HTTP/1.1 200 OK Super secret info about the anti- Death Eater rally!

Slide 56

Slide 56 text

HTTP :( not so secret now HTTP/1.1 200 OK Super secret info about the anti- Death Eater rally! Voldemort-in-the-middle

Slide 57

Slide 57 text

HTTPS wow ? AmfhZQFJ6lBRRWWRyHfOwmLnF4Zi7 HafGjXMfDdvm2KRd3qXhxOoeTP9vy ddrZ05o4PkE86q54ySQOJA6UwwHt0 NxQ+0RO0/ DnRbbPs1phgVX6wrZ93PVRLP xxHPwNBOQZg0qcxvEcl2fixs/ OtxhEHNfhlB

Slide 58

Slide 58 text

HTTPS not so wow AmfhZQFJ6lBRRWWRyHfOwmLnF4Zi7 HafGjXMfDdvm2KRd3qXhxOoeTP9vy ddrZ05o4PkE86q54ySQOJA6UwwHt0 NxQ+0RO0/ DnRbbPs1phgVX6wrZ93PVRLP xxHPwNBOQZg0qcxvEcl2fixs/ OtxhEHNfhlB dns wizardry

Slide 59

Slide 59 text

HTTPS not so wow the rally is at this TOTALLY INCORRECT place dns wizardry

Slide 60

Slide 60 text

HTTPS not so wow I want to join Dumbledore’s Army and this is my name, address, bank account, and other unnecessarily personal info.

Slide 61

Slide 61 text

HTTPS not so wow I want to join Dumbledore’s Army and this is my name, address, bank account, and other unnecessarily personal info. I want to join Dumbledore’s Army and this is my name, address, bank account, and other unnecessarily personal info.

Slide 62

Slide 62 text

Encryption keys are unique!

Slide 63

Slide 63 text

Certiﬁcate: public key + metadata!

Slide 64

Slide 64 text

Signed Certiﬁcates

Slide 65

Slide 65 text

Signed Certiﬁcates

Slide 66

Slide 66 text

Chain of trust

Slide 67

Slide 67 text

Chain of trust Root certiﬁcate authority certiﬁcates are installed on your computer/ phone/browser.

Slide 68

Slide 68 text

Hello, I’d like to talk to Harry’s blog securely Yes this is Harry’s blog, v secure! Hold up, why should I trust that you’re actually Harry? Because Diagon Alley Hosting says so. Hey Diagon Alley Hosting, do you know this guy? Yes, we can vouch for him. But how do I know who you are? Look me up with Gringotts Identities.

Slide 69

Slide 69 text

Try your DNS tricks now, Voldy!

Slide 70

Slide 70 text

Why should I use HTTPS on my websites? • Protects your users from snooping. • Will raise hell if someone pretends to be you.

Slide 71

Slide 71 text

Why doesn’t everybody do this? • Money. • Pain. Bureaucracy + encryption = not cute.

Slide 72

Slide 72 text

Let’s Encrypt! • nginx https://www.digitalocean.com/community/ tutorials/how-to-secure-nginx-with-let-s-encrypt-on- ubuntu-14-04 • apache https://www.digitalocean.com/community/ tutorials/how-to-secure-apache-with-let-s-encrypt- on-ubuntu-14-04

Slide 73

Slide 73 text

No content

Slide 74

Slide 74 text

Shared hosting providers that support Let’s Encrypt https://github.com/letsencrypt/letsencrypt/wiki/Web- Hosting-Supporting-LE

Slide 75

Slide 75 text

What can I do as a user? • HTTPS everywhere browser extension • https://chrome.google.com/webstore/detail/https-everywhere/ gcbommkclmclpchllfjekcdonpmejbdp?hl=en • https://addons.mozilla.org/en-US/ﬁrefox/addon/https-everywhere/ • Ad and tracker blocking • https://chrome.google.com/webstore/detail/ublock-origin/ cjpalhdlnbpaﬁamejdnhcphjbkeiagm?hl=en • https://www.eff.org/privacybadger

Slide 76

Slide 76 text

What can I do as a developer? • Learn how to be evil! • Starting with https://wireshark.org • cybrary.it • Books from NoStarch Press: The Tangled Web, Silence on the Wire, Penetration Testing, etc. • Learn about the security features in the tools and frameworks you use!

Slide 77

Slide 77 text

More resources • “Server Farm to Table” — http://jenna.is/server-farm-to- table-annotated.pdf • Computerphile “Man in the Middle attacks” — https:// www.youtube.com/watch?v=-enHfpHMBo4 • Computerphile “Public key cryptography” — https:// www.youtube.com/watch?v=GSIDS_lvRv4 • “Cat DNS” — https://www.youtube.com/watch? v=qDPhW9P44fI • pi-hole.net — connect to your router to block ads