Recomendados
Recomendados
Más contenido relacionado
Similar a Control-Flow Integrity
Similar a Control-Flow Integrity (20)
Último
Último (20)
Control-Flow Integrity
- 9. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store
- 10. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID
- 11. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order ID
- 12. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order IDSkips PayPal
- 13. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order IDSkips PayPal Collects signed Order ID
- 14. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order ID Attacker buys low- cost item
- 15. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order ID Attacker buys low- cost item Attacker substitutes High-Cost Order ID
- 16. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order ID Attacker buys low- cost item Attacker substitutes High-Cost Order ID Repeat
- 17. PayPal • Collects Payment Store • Session = PAID PayPal • Returns Buyer to store Store • Signs Order ID Store • Validates session and Order ID Attacker buys low- cost item Attacker substitute s High- Cost Order ID Repeat Store verifies the Order ID matches the session
- 21. PayPal • Collects Payment Store • Token = PAID
- 22. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store
- 23. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAID
- 24. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAID Attacker buys first item
- 25. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAID Attacker copies token value Attacker buys first item
- 26. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAIDSkips PayPal
- 27. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAIDSkips PayPal Attacker uses PAID token
- 28. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAIDSkips PayPal Attacker uses PAID token Repeat
- 29. PayPal • Collects Payment Store • Token = PAID PayPal • Returns Buyer to store Store • Confirms token PAIDSkips PayPal Attacker uses PAID token Repeat Store limits token to one time use
- 32. Framework Survey
- 33. CFI Attacks • Unsolicited Request Sequences • Compromising Use of the “Back” Button • Race Conditions • HTTP Parameter Manipulation
- 34. Unsolicited Request Sequences • Follow arbitrary sequence in flow • Single session • Cross-session • Omit steps in flow
- 35. Back Button • Re-do last action • Follow another path
- 36. Race Conditions • Actions initiated by attacker simultaneously • Multi-tab (single session) • Multi-browser (multiple session) • (Buy.com example)
- 37. Param Manipulation • Manipulated values • Predicted values • Cross-session tampering • Unexpected input
- 38. Root Cause • Developer expects users to follow paved path through application • No enforcement if they don’t • Sometimes see it show up when a user bookmarks a deep-link
- 40. Integration • Enforcement must be placed in place where every request passes through it • Easiest with MVC-type apps • Otherwise, called first for each request
- 41. Protection Goals • Back button support • Multi-tab support • Race condition prevention • Parameter validation • Omit protection for public pages • Enforce flow sequence
- 42. Back Button Support • Detect back button was used by looking at currently requested step and determining if it was the step just previous to the last one
- 43. Multi-Tab Support • Implement JavaScript handler • XHR (aka AJAX) request when tab open, closed or tab-switch • Each tab assigned unique tab ID • Enforce CFI on per-tab basis
- 44. Race Condition Prevention • Implement lock using session ID • Lock is for all tabs with same session ID • Lock is for specific resource • Other sessions are not affected • Other resources are not affected
- 45. Param Validation • Define data type and enforce • Optionally mark as WORM (write once, read many) • Blacklist of params to exclude
- 46. Omit Protection • Designate portions of site that don’t need CFI protection.
- 47. Enforce Flow Sequence • All flows must be defined • Page names and corresponding URLs must be determined • pg1 = /step1 • pg2 = /step1?tos=1
- 48. Flow Sequence Language • flow1 -> flow2 • flow1 -> (flow2 | flow3) • ?flow1 (allow back button) • !flow1 (enable race protection) • @flow1 (repeatable step)
- 49. Flow Sequence Example • Buyer adds items to cart • Buyer navigates to checkout and is presented with totoal • Buyer opens another tab, adds more items to shopping cart • Buyer returns to payment tab and pays
- 50. Flow Sequence Example Checkout.logIn -> Payment.chooseMethod -> Payment.validateStatus -> Checkout.completeOrder
- 51. Performance
- 52. Thank You!