JS Suicide: Using Javascript's security features to kill itself

BlackHat Asia 2014, Singapore.

JavaScript today has a presence in almost every single website across the Internet. Aggressive research is in progress in the security community to come up with better security features in JavaScript everyday. Unfortunately, many security features of JS are a double-edged sword. In this presentation, we will show how some of the security features in JavaScript can be used maliciously by an attacker to kill other security features in any website. More specifically, we will see how the sandboxing features of ECMAScript 5 can break and make security in modern day applications. We also take a few real world examples like OWASP CSRFGUARD and use some of the major security features of JS to bypass CSRF protection offered by this OWASP library in many different ways.

Transcript

1. JS  Suicide:  Using  JavaScript  Security  Features  to   Kill  JS  Security     Ahamed  Nafeez   @skeptic_fx
2. Agenda JavaScript  of  all  things   ! Objects  and  ECMAScript  5   ! The  Principle  of  Unobtrusive  JavaScript   ! The  sad  story  of  OWASP  CSRFGuard   ! Hunting  down  insecure  DOM  Properties   !
3. What  to  expect  today? This  talk  is  about:   • Using  JavaScript’s  features  to  attack  its  implementations.   • Bypassing  OWASP  CSRFGuard’s  protection.   • DOM  Clobbering.   ! This  talk  is  NOT  about,  how  to  do   • Cross  site  scripting   • Cross  site  request  forgery   • Or  the  usual  stuff  you  hear  in  JS  Security  like  eval,  Global   Objects  etc.
4. #whoami ! Ahamed  Nafeez   ! Security  Engineer  by  day,  with  above  average  interest  in   Web  and  Networks.   ! I  believe,  Defending  and  Building  secure  software  is  harder   than  attacking.   ! blog.skepticfx.com   ! This  talk  does  not  represent  the  view  of  my  employer.   ! 

5. JavaScript  of  all  things
6. Enough  JS  Primer  for  today Dynamic  language   ! Object-­‐based   ! Functions  are  first  class  citizens  
7. Native  Objects
8. Object   Array   Number
9. Host  Objects
10. DOM  -­‐  Browsers   http,  dns  -­‐  Nodejs
11. ECMAScript  5
12. Tamper-­‐Proof  Objects   ! var  point  =  
 {  a:  1,  b:  2  }
13. Object.defineProperty(point,  'a',  {   get:  function()   {return  'Always  faked'}   });
14. point.a;  //  ‘Always  Faked’   point.a  =  200;   point.a;  //  ‘Always  Faked’
15. Object.preventExtensions(point)   ! point.c  =  3;
 //  Error:  Cannot  set  Property
16. Object.seal(point)   ! delete  point.a;
 //  Error:  Cannot  delete  Property
17. Object.freeze(point)   ! point.a  =  100;
 //  Error:  Cannot  change  Property
18. The  principle  of  unobtrusive  JavaScript
19. 19 Going  Unobtrusive
20. Almost  Static  HTML
 Dynamic  Data  over  JavaScript   via  XHR,  JSON  etc
22. Cached  HTML  pages   Non-­‐Cached  JavaScript  pages
23. Where  do  I  put  my  dynamic  +  secret   artifacts?
24. OWASP  CSRFGuard Synchroniser  token  pattern.   ! Injects  ANTI-­‐CSRF  tokens  in  to  pages  dynamically   ! Completely  compatible  with  the  principle  of  UnObtrusive   JavaScript
25. Where  did  they  keep  their  tokens?
27. Smells  fishy  !
28. An  attacker  could  load  this  JS  file  from  a   Cross-­‐Domain  website  and  steal  this   token.
29. The  library  did  protect  against  that
30. Lets  introspect  isValidDomain() If  this  returns  True,  the  check  is  bypassed.
31. Custom  String.prototype
32. Bypass  1  -­‐  Prototype  Overriding Always  return  True Freeze  the  String.prototype  Object,  
 So  CSRFGuard  cannot  redefine  it. override.js
33. 33 Bypass  1  -­‐  Continued  .  .  . Load  the  CSRFGuard  JS  File  from  good.com Walk  the  DOM  and  read  the  CSRF  Token  injected  by  the  library.
34. Lets  attempt  to  fix  this Object.isFrozen()  tells  whether  an  Object  is  already  frozen.
35. Did  you  know?   !     
 Object.isFrozen()  can  be  spoofed  as   well?
36. 36 Attacker  can  return,  ‘false’  always  
37. 37 Bypassing  the  isFrozen()  Fix  
38. 38 ! ! Lets  try  another  way  to  bypass  this   whole  situation.     ! Just  for  Fun.
39. 39 Revisiting  the  Check The  whole  check  depends  on  the  value  of   document.domain
40. Wait  !  document.domain  is  a  lie
41. Bypass  2 41 Make  document.domain     always  return  good.com
42. How  to  deal  with  this  situation?
43. Do  not  Hard  Code  the  Dynamic  +  Secret   artifacts. 1.  Embed  them  inside  your  DOM  such  as  META  tags  and  read  from  JS 2.  Send  an  XHR  request  and  read  it.  So  the  token  is  protected  by  Same  Origin  Policy
44. Upgrade  to  CSRFGuard  3.1
45. DOM  Clobbering
46. Names  and  IDs  of  form  controls  are  treated   as  properties  to  the  FORM  Element.
47. Think  about  JS  Frame  Busters Used  to  prevent  against  UI  Redressing  attacks.   Some  people  still  use  this    alongside,   the    X-­‐Frame-­‐Options  header.
49. If  an  Attacker  can  control  form  fields
50. The  DOM  is  a  Mess  !   ! @garethheyes    -­‐     http://www.thespanner.co.uk/2013/05/16/dom-­‐clobbering/
51. Hunting  down  Objects  which  can  be   tampered
52. 52 Object.getOwnPropertyDescriptor Look  for  the  ‘configurable’  property
53. 53 Location  Properties  in  Chrome
54. Things  to  keep  in  mind Today,  a  developer  can  only  rely  on
 location.href,  as  the  only  trusted  source  of  location.   ! Every  other  location  properties  can  be  spoofed  and  played   around  with.   ! You  can  try  fuzzing  various  different  properties  and  use   them  in  your  pen  tests  /  research  accordingly.  
55. You  should  follow Mario,  @0x6D6172696F   ! Gareth  Heyes,  @garethheyes     ! Yosuke  Hasegawa,  @hasegawayosuke     ! Lavakumar,  @lavakumark   ! And  a  few  more,  that  I  don’t  have  space  to  mention  here.   !
56. THANK YOU ! @SKEPTIC_FX ! KEEP STORMING THE DOM :)