Defeating Web 2.0 Attacks without Recoding Applications

OWASP & WASC AppSec 2007 Conference

San Jose – Nov 2007 http://www.webappsec.org/

Amichai Shulman CTO, Imperva

[email protected]

972-3-6840100 Copyright © 2007 - The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the Creative Commons Attribution-ShareAlike 2.5 License. To view this license, visit http://creativecommons.org/licenses/by-sa/2.5/

The OWASP Foundation

http://www.owasp.org/

Goals and Agenda

 Detection and Mitigation of JS-Hijacking and CSRF Attacks  Attack intro  Code based solution  Gateway based solution  Detecting Fraud Attempts that Exploit CSRF and JS-Hijacking Vulnerabilities

OWASP & WASC AppSec 2007 Conference – San Jose – Nov 2007 2

Why CSRF and JS-Hijacking

 JS-Hijacking is a newly discovered web 2.0 related vulnerability  CSRF has been given a lot of attention lately. Experts predict that it’s becoming the major issue in web security  Traditional mitigation techniques are not suitable for cost-effective implementation  To-date businesses are not properly protected against web frauds

OWASP & WASC AppSec 2007 Conference – San Jose – Nov 2007

Introduction to JS Hijacking

 Introduced by Fortify on March 12, 2007  Specific to applications who use Javascript as data transfer format – AJAX applications  Abuses a loophole in the browser’s Same Origin Policy  A script from any domain can be included and executed in the context of any other web site  If the script is used for application data transfer (it contains sensitive data in the form of JS arrays) that sensitive information can be accessed by code from a different domain  Most notable example: gmail contact list

OWASP & WASC AppSec 2007 Conference – San Jose – Nov 2007

Introduction to JS Hijacking

www.mybank.com

Log in and retrieve information www.attackercontrolled.net

…