Ajax Security

OWASP – Ajax Security Roberto Suggi Liverani Security Consultant Security-Assessment.com 5 December 2007

Who am I? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Introduction ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax Components (cont.) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax Components ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax Components – Simple Diagram

Let’s define Ajax: ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Traditional Web Model vs Ajax Web Model

Classic Web Model – Usability/Time

Ajax Web Model – Usability/Time

Why Ajax is used? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who is using Ajax? And many others…

Let’s talk about Ajax and security… ,[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax and Security – Server of origin policy ,[object Object],URLs Cross – Scripting allowed? Comments http://www.example.com:8080/script1.js No Port number doesn’t match. http://www.example.com/script2.js http://www.example.com/script1.js No Protocol type doesn’t match. https://www.example.com/script2.js http://www.example.com/script1.js No Browser will not perform domain name resolution. http://192.168.0.10/script2.js http://sub.example.com/script1.js No Subdomains treated as separate domains. http://www.example.com/script2.js http://www.example.com/hello/script1.js YES Domain name is the same. http://www.example.com/bye/script.2.js http://www.example2.com/script1.js NO Different domain names. http://www.example1.com/script2.js

Ajax and Security – Server of origin policy ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Real attacks examples ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax Security – Case Study – Samy worm ,[object Object],[object Object],[object Object],[object Object]

Ajax – Case Study – Samy worm (cont) ,[object Object]

Screenshot showing list of Myspace profiles infected by Samy Worm

And today there are still Myspace accounts with Samy as a hero! 532 results with live.com

Ajax – Case Study – Samy worm ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax – Case Study – Yamanner worm ,[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax – Case Study – Yamanner worm ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax – Case Study – Nduja - Webmail XSS worm ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax Security – Case Study – Nduja - Webmail XSS Worm ,[object Object],[object Object],[object Object],[object Object],[object Object]

Web worms – Comparison So the question is: Can you think about the impact of the next cross domain web worm? Worm Target Domain(s) Cross Domain? Impact Samy worm Myspace.com No 1 million of users affected Yannamer worm Yahoo.com No Unknown number of yahoo users affected Nduja worm Tiscali.it Libero.it Lycos.it Excite.com Yes N/A – This is a PoC

Questions/Conclusion ,[object Object],[object Object]

References – Misc. ,[object Object],[object Object],[object Object],[object Object],[object Object]

References – Misc. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

References – Books ,[object Object],[object Object],[object Object]

Table of Figures ,[object Object],[object Object],[object Object],[object Object],[object Object]

Ajax Security

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Ajax Security

Similar to Ajax Security (20)

Recently uploaded

Recently uploaded (20)

Ajax Security