Distill: Death to Cookies

Death to Cookies Konstantin Haase @konstantinhaase

story time

once upon a time

Recipetastic™

Bob Alice

Bob Alice Eve

Bob Alice Mallet

problem solved

POST /login HTTP/1.1 Host: www.recipetast.ic Content-Length: 44 email=bob@builder.com& password=st0p%20Motion

HTTP/1.1 200 OK Content-Type: text/html Set-Cookie: user=bob <html> ...

GET / HTTP/1.1 Host: www.recipetast.ic Cookie: user=bob

Guessing

HTTP/1.1 200 OK Content-Type: text/html Set-Cookie: user=bob Set-Cookie: pwd=... <html>
...

GET / HTTP/1.1 Host: www.recipetast.ic Cookie: user=bob,pwd=...

GET / HTTP/1.1 Host: www.recipetast.ic Cookie: user=bob,pwd=... Basic Auth, just
with cookies

HTTP/1.1 200 OK Content-Type: text/html Set-Cookie: user=bob Set-Cookie: token=... <html>
...

XSS Cross Site Scripting

can read cookie and send it somewhere

HTTP/1.1 200 OK Content-Type: text/html Set-Cookie: user=bob; HttpOnly <html> ...

can read (and write) recipes

sanitize all user input

Content Security Policy

CSRF Cross Site Request Forgery

Is this awesome, y/n?

GET /create?… HTTP/1.1 Host: www.recipetast.ic Cookie: user=alice

GET /create?… HTTP/1.1 Host: www.recipetast.ic Cookie: user=alice Deadly cookies!

GET, HEAD, OPTIONS, TRACE PUT, DELETE, LINK, UNLINK POST, PATCH

1 2 PUT / 2 PUT / 2 Repeatable! :)
State change! :( Deterministic! :) https://speakerdeck.com/rkh/we-dont-know-http

GET, HEAD, OPTIONS, TRACE PUT, DELETE, LINK, UNLINK POST, PATCH

POST /create HTTP/1.1 Host: www.recipetast.ic Cookie: user=alice ...

POST /create HTTP/1.1 Host: www.recipetast.ic Cookie: user=alice ... Deadly cookies!

POST /create HTTP/1.1 Host: www.recipetast.ic Referer: http://awesome- website.com/ Cookie: user=alice

POST /create HTTP/1.1 Host: www.recipetast.ic Referer: http://awesome- website.com/ Cookie: user=alice
[sic]

Referer is not set for FTP or HTTPS referrers

Referer can be spoofed by outdated ﬂash plugin

POST /create HTTP/1.1 Host: www.recipetast.ic Origin: http://awesome- website.com Cookie: user=alice

Not supported by older browsers

Origin can probably be spoofed by outdated ﬂash plugin

HTTP/1.1 200 OK Content-Type: text/html Set-Cookie: csrf_token=XXX

Cheating Same Origin

HTTP/1.1 200 OK Content-Type: application/json

An attacker could just load it, right?

AJAX can only load from the same origin (or CORS)

seems harmless

In JavaScript, you can override the array constructor.

https://github.com/rkh/json-csrf

Never serve JSON that has an array at top level
(or don’t use cookies)

VBScript did not fully implement Same Origin

Block Internet Explorer before IE9

require CSRF token for all AJAX requests

Are we doing good so far?

Can we trust a cookie?

DNS cache poisoning

Can we trust the browser?

Can we trust browser plugins?

Signed Cookies

Encrypted Cookies

Eaves- dropping

encrypting cookies does not help

attacker cannot parse cookie from stream

Or can they?

BEAST Browser Exploit Against SSL/ TLS

decrypts TLS 1.0 streams via injected JavaScript

ﬁxed in TLS 1.1

force recent browser

don’t allow TLS 1.0

CRIME Compression Ratio Info-leak Made Easy

SSL has built-in compression

GET /?user=alice HTTP/1.1 Host: www.recipetast.ic Cookie: user=bob GET /?user=bob HTTP/1.1
Host: www.recipetast.ic Cookie: user=bob better compression

update your browser

turn off SSL compression

append random number of bytes to response

BREACH Browser Reconnaissance and Exﬁltration via Adaptive Compression of Hypertext

like CRIME, but for the response

attack the CSRF token, not the cookie

inject something in the response http://www.recipetast.ic/search?q=XXX

mask CSRF tokens differently in every response (Rails PR pending)

don’t use CSRF tokens

Do you think about all this when you build an
app?

Next attack vector around the corner?

Alternatives

IP address

Session ID in URL

Custom Authorization header

Store value in Local Storage

Needs JavaScript :(

Works well with PJAX/ Turbo Links like setups

New Browser Concepts?

@konstantinhaase konstantin@travis-ci.org rkh.im

Distill: Death to Cookies

Distill: Death to Cookies

More Decks by Konstantin Haase

Other Decks in Technology

Featured

Transcript