My talk on client side web security as given at the jQuery Conference 2014 in San Diego
Hacking Front-End AppsAlex Sexton
View Slide
I work at .
which is in .California
but…
I live in .Texas
The web has a lot incommon with Texas.
“The wild west.”
In 1985, Texas had a problem.
Littering
Some Texans defended their“God-given right to litter.”
ಠ_ಠ
There were fines for littering.
photo by Curtis Gregory Perry
But no one seemed to care.
The state tried some slogans.
But these slogans apparentlydid not resonate withthe core offenders
Males 18-24“Bubbas in Pickup Trucks”
In 1985 Texas trieda new campaign:
The campaign reduced litteron Texas highways!72%!from 1986 to 1990.
My point is…
“Hey everyone, you should make yourwebsites more secure because it’s important.”!Probably isn’t going to do the trick.
DON’T!MESS!WITH!XSSAlso probablywon’t work.
Web developers,not security researchers,are the core audience.
Web security is hard.
“All you have to do is nevermake a single mistake.”- I Think Mike West
“I discount the probabilityof perfection.”- Alex Russell
Content Injection
Everyone has a friend thatalways seems to pick“alert(‘hacked!’);” as their username.
My User Agent
My Friend, Mike Taylor’s User AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) alert(‘lol’); Gecko/20100101 Firefox/25.0
Samy
So let’s just detectmalicious scripts!
alert(1)
The Billy HoffmanWhitespace Attack <br/>!<br/>
The Billy HoffmanWhitespace Attack <br/>!<br/>Malicious Code
The Billy HoffmanWhitespace Attack <br/>!<br/>tabtab tabspace space
The Billy HoffmanWhitespace Attack <br/>!<br/>11 10 0
You cannot detectmalicious code.
output.replace(//, ‘’);<br/>
CSS Hacks
Old School
Link Visited LinkgetComputedStyle( getComputedStyle( )) ===\o\|o|/o/Pretty muchPeople Celebrating(or screaming on fire)
Timing Attacks
Security by Inaccuracy
requestAnimationFrame + :visited = ಠ_ಠ
Link Visited Link
Link Visited Link<16ms>60msTime to render
JSON-P
MORE LIKEJSON-Pretty-Insecure
“I’d really like it if someone could runarbitrary dynamic scripts on my page”- JSONP Users
You wouldn’t do this.
So don’t do this.
A Leak In The Response
YouProbablyShouldUseCORS.tumblr.com
enable-cors.org
Try to sayCROSS SITE!REQUEST FORGERY5 times fast.
Set-Cookie ‘csrf=0003’
It gets worse.
Contextis White Paper
Cross-Domain Data Snoopingvia SVG Filters and OCR
We need a new approach.
ContentSecurityPolicy
Disallow Inline JS, CSSBy Default!
Disallow evalBy Default!
Disallow Cross DomainJS, CSS, IMG, Fonts
Report Violations!
A White ListThat’s the key!
Good Security GoesBeyond Content Injection
HTTPS Everywhere
HTTPS Only
301 Redirecthttp
httpsHSTS
Frame Busting
Disallow asan iFrameX-Frame-Options
It’s “security by default.”At least muchcloser…
You can rely a little less onbeing perfect.
it only matters ifeveryone buys in.But
We need our own slogan.
We need developers totake pride in makingsecure applications.
Don’t Mess With The Web
Let’s do something aboutit together.
Thanks!@SlexAxtonSpecial Thanks To:Mike West * 1000Adam BaldwinContextisMDN
slexaxton
yokawasa
minorun365
peisuke
takanorig
codenote
tyrmanuz
radkmb
mosa_siru
iamshunta
mtx2s
line_developers_tw
sat
malarkey
tammyeverts
palkan
sonatard
cassininazir
trishagee
samanthasiow
holman
dougneiner
dotmariusz
jnunemaker
sugarenia