Se ha denunciado esta presentación.
Utilizamos tu perfil de LinkedIn y tus datos de actividad para personalizar los anuncios y mostrarte publicidad más relevante. Puedes cambiar tus preferencias de publicidad en cualquier momento.

Web Wuermer

1.795 visualizaciones

Publicado el

Talk slides for the RU Bochum 01.2010 - German language

  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Responder 
    ¿Estás seguro?    No
    Tu mensaje aparecerá aquí
  • If you want to download or read this book, copy link or url below in the New tab ......................................................................................................................... DOWNLOAD FULL PDF EBOOK here { http://bit.ly/2m77EgH } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m77EgH } .........................................................................................................................
       Responder 
    ¿Estás seguro?    No
    Tu mensaje aparecerá aquí
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Responder 
    ¿Estás seguro?    No
    Tu mensaje aparecerá aquí
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Responder 
    ¿Estás seguro?    No
    Tu mensaje aparecerá aquí
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Responder 
    ¿Estás seguro?    No
    Tu mensaje aparecerá aquí
  • Sé el primero en recomendar esto

Web Wuermer

  1. 1. Web Würmer Klein, glitschig und ekelhaft Mario Heiderich
  2. 2. Vorstellung ● Mario Heiderich ● PHPIDS ● Trainings ● Audits und Pentests ● Secure Development
  3. 3. Überblick ● Ein wenig Geschichte ● Fallbeispiele ● Limitationen ● Und Wege diese zu umgehen ● Blick in die Zukunft ● Diskussion
  4. 4. Erste Gehversuche ● 1999 - 2002 ● Attacken gegen Hotmail ● Outlook Webaccess ● Ein völlig neues Thema ● Internet Explorer 5.5
  5. 5. Samy ● 2005 ● Just to be popular ● Hat funktioniert ● MySpace down ● FBI, Arrest und Auflagen ● 2010 - und Samy ist zurück...
  6. 6. Yamanner ● 2006 ● Mailworm ● Adressdaten harvesten ● SPAM
  7. 7. Der Pornowurm ● 2007 ● 1 Mio User ● Lediglich ein PoC ● XSS Attacken und persönliche Reputation ● Emailadresse und sexuelle Präferenzen ● Reported aber nie gefixt
  8. 8. Nduja Connection ● 2007 ● Mailworm ● Mehrere italienische Freemailer ● Cross Domain ● Nur ein PoC
  9. 9. Der nette Wurm ● 2007 ● Wordpress ● Heilsamer Payload ● Propagation via Scanning und Blogroll ● Große Coverage in den Medien
  10. 10. Jikto ● 2007 ● Cross Domain ● PoC Wurm für einen Shmoocon Talk ● “Geleakter” Sourcecode ● SOP Normalisation via Google Translate ● Big buzz
  11. 11. Diminutive Worm Contest ● 2008 ● “Den Kürzesten haben” ● Webworm aus ca. 150 Bytes als Resultat ● Erstmalig HTML als Wurmgerüst ● Contest mit Botschaft
  12. 12. Justin.TV und andere ● 2008 ● Adressdaten sammeln ● Logindaten als Plaintext ● SPAM
  13. 13. Rediff.com ● 2009 ● Mailworm ● 60 Millionen betroffene User ● Nutzt kleine Lücke im HTML Filter
  14. 14. Reddit, Twitter,... ● 2009 ● Spam, SEO, Account Hijacking etc ● Facebook Apps running wild ● Orkut ● Und viele andere...
  15. 15. Mehr mehr MEHR! ● Quellen diverser Würmer sind online ● Teils mit Erläuerungen ● sla.ckers.org ● AJAX Worm Database ● namb.la/popular
  16. 16. Bilanz und Warten auf 2010 ● Schlechter Code ● Lediglich String Obfuscation ● Potenzial noch nicht ausgereizt ● Meist fokussiert auf die betroffene App ● Mangelhafte Infrastruktur
  17. 17. Heutige Probleme ● Wenige verstehen XSS ● Gleiches für CSRF ● Und erst recht die Kombination ● Dabei ist's nicht so schwer ● Und HTTP ist immer noch an allem Schuld ● Oder?
  18. 18. Goldene Regel ● Remote XSS und Applikation mit Login == Wurm ● Auch reflektiver XSS – dank short URLs ● HttpOnly ist kein Hindernis ● Warum?
  19. 19. Anatomie eines Wurms ● Initiale XSS Lücke ● Data Storage ● Payload Propagation ● Wurmkopf ● MVC oder was?
  20. 20. Eigenschaften eines Wurms ● Was sind die wichtigsten Eigenschaften? ● Wie werden diese implementiert?
  21. 21. Klar... ● Propagation ● Payload ● Stealthiness ● Robustness ● Obfuscation ● Defence
  22. 22. Klassiches Design ● Altbekannte Prinzipien ● Klare Gewaltenteilung ● Strukturelle Schwäche
  23. 23. Fallbespiel ● Yamanner ● View - die Lücke im Yahoo! Mail Frontend ● Controller - Der Payload ● Model - Ein PM System einer anderen Website ● Sauber strukturiert - aber... ● Einfach zu eliminieren
  24. 24. Warhhol Würmer ● Kurzlebigkeit ● Instabilität ● Offensichtlichkeit ● No money shots
  25. 25. Wer kanns besser? ● Botnetze ● Mass SQL Injections ● "Binary Worms"
  26. 26. Vorteil Infrastruktur? ● P2P Architekturen ● Dezentrale C&C Server ● Obfuscation ● Verschlüsselung – richtig echte ● Rechenleistung und Plattenplatz
  27. 27. Zurück zum Webworm ● Was fehlt zum echten Wurm?
  28. 28. Eigentlich nichts ● Das Internet als Infrastruktur ● Verfügbar, dezentralisiert und schnell ● Services im richtigen Kontext sehen ● Alle Komponenten eines “Binary Worms” haben Web-Repräsentanten
  29. 29. Controller ● Business Logik ● Yahoo! Pipes ● AppJet ● Codepad ● PHP, C++, JavaScript,...
  30. 30. Dinge im Hintergrund ● AJAX Requests ● DOM Worker ● Schnittstellen zu OS und Applikationen ● ActiveX, PDFs, Videos,...
  31. 31. Model ● Pastebins ● Image Hoster ● Twitter, Delicious und andere ● Einfach dank Tagging ● Web-RAID und mehr...
  32. 32. Client Side Storage ● So viele APIs ● Bekannte wie W3C Storage APIs ● Und weniger bekannte Vertreter wie #userdata ● Oder HTML+TIME
  33. 33. Payload obfuscation ● String Obfuscation und mehr ● Wir hatten das bereits... ● location.hash ● window.name ● Aynwhere in DOM country ● Bilder, Farben, Subdomains, Dateinamen, ...
  34. 34. Robustness ● Escaping und Encoding ● Base64 – nicht alle User Agents ● escape() ● encodeURIComponent() ● Markup nutzen
  35. 35. Propagation ● Scanning und Fuzzing ● Spidering ● Google und Yahoo! Search API ● Code Search Engines
  36. 36. JavaScript und HTTP ● AJAX wenn möglich ● XDR ● Cross-Domain ● Lesend zum Harvesten ● Nicht-lesend zum Verbreiten ● new Image().src='http://...'
  37. 37. Crossing the Line ● Requests an beliebige Domains ● Requests an beliebige Protokolle ● Requests an beliebige Ports ● Shodan
  38. 38. Wenig Limits ● SOP als einziges Hindernis ● Komplexer als man denkt ● Single Point of Failure ● 2009 wie oft genau gefallen?
  39. 39. Und noch weiter... ● Intranet Würmer ● OTRS, phpMyAdmin, Plesk ● Würmer in Entwicklungsumgebungen ● Eclipse, Trac, ... ● Politische Foren und Abstimmungssysteme ● Mobile Botnetze via XSS
  40. 40. Zusammenfassung ● Web-Würmer können mehr ● Trusted User Interaction simulieren ● Dezentrale Controller ● Dezentrale und inhomogene Models ● Cross-Domain und Cross-Protocol
  41. 41. Warhol war einmal ● Persistente Webworms sind möglich ● Nur gibt es noch keinen ● Zeit einen zu bauen! ● Oder?
  42. 42. Rechtliches ● Keine einfache Lage ● Mehr eine völlige Blackbox – siehe §202c ● Gerade noch ein PoC... ● ...oder schon eine Straftat? ● Kompliziert in EU und USA
  43. 43. Was kann man tun? ● Dilemma Diversität ● Zuviele Kombinationen aus Services ● Messerblock und Säurefässchen ● CSE oder Exploit Search Engine?
  44. 44. Diskusssion
  45. 45. Vielen Dank!
  46. 46. Vielen Dank! ● mario.heiderich@gmail.com ● http://heideri.ch ● https://twitter.com/0x6D6172696F

×