Scriptless Attacks - Stealing the Pie without touching the Sill
61 likes46,924 views
- The document discusses scriptless attacks that can bypass traditional XSS defenses like NoScript and XSS filters by leveraging new HTML5 and CSS features. - It presents several proof-of-concept attacks including using CSS to steal passwords, using SVG fonts to brute force CSRF tokens, and using custom fonts to leak sensitive information like passwords without using JavaScript. - The attacks demonstrate that even without scripting, features in HTML5 and CSS can be abused to conduct traditional XSS attacks and undermine security defenses, so more work is needed to protect against side-channels and unwanted data leakage from the browser.
![Chapter one
[ These simple Tricks ]](https://image.slidesharecdn.com/stealingthepie-121220134121-phpapp02/85/Scriptless-Attacks-Stealing-the-Pie-without-touching-the-Sill-8-320.jpg)
![Analysis
● What really happens
● The attacker, Clive, injects CSS...
– input[type=password]{content:attr(value)}
● Then he includes a custom SVG font
– @font-face {font-family: X;src: url(x.svg#X)
format("svg");}
● The attacker simply flips characters
– s becomes x, e becomes w, c becomes @ …
● By thinking it's a CAPTCHA...
● … Alice submits her password to the attacker](https://image.slidesharecdn.com/stealingthepie-121220134121-phpapp02/85/Scriptless-Attacks-Stealing-the-Pie-without-touching-the-Sill-10-320.jpg)
![Already done
●
SDC, Gaz and thornmaker already did it
● Check out http://p42.us/css/
●
They used CSS
● Basically a brute-force via attribute selectors
●
input[value^=a]{background:url(?a)}
● If the server catches GET /?a...
● The first character is an a
● But then what?
●
There's no „second or Nth character selector“
●
They had to go input[value^=aa]{background:url(?aa)}](https://image.slidesharecdn.com/stealingthepie-121220134121-phpapp02/85/Scriptless-Attacks-Stealing-the-Pie-without-touching-the-Sill-21-320.jpg)
Scriptless Attacks - Stealing the Pie without touching the Sill
- 1. Scriptless Attacks Stealing the Pie without touching the Sill Mario Heiderich, Felix Schuster, Marcus Niemietz, Jörg Schwenk, Thorsten Holz ACM CCS 2012 HGI / Chair for Network and Data Security Ruhr-University Bochum mario.heiderich@rub.de || @0x6D6172696F
- 2. Our Dear Speaker ● Dr.-Ing. Mario Heiderich ● Researcher and Post-Doc, Ruhr-Uni Bochum – PhD Thesis on Client Side Security and Defense ● Founder of Cure53 – Penetration Testing Firm – Consulting – Simply the Best Company of the World ● Published author and international speaker – Specialized in HTML5 and SVG Security – JavaScript, XSS and Client Side Attacks ● HTML5 Security Cheatsheet – @0x6D6172696F – mario@cure53.de
- 3. Background
- 4. Cross Site Scripting ● Lots of talks have been held ● Plenty of research has been done ● Traditional injections ● Attacks from outer space ● XSS, XAS, XDS, XSSQLI, SWXSS, … you name it! ● Defense mechanisms on multiple layers ● Network, Server, Client and what not... – CSP, NoScript, AntiSamy and HTMLPurifier, Tripwires, Browser XSS Filters – mod_security, PHPIDS, some (often nonsense) WAF products ● But why use scripting at all?
- 5. Topics Today ● Scriptless Attacks in your Browser ● Attacks bypassing NoScript ● Attacks bypassing XSS Filters ● Attacks bypassing Content Security Policy ● Thought Experiment ● What if we defeat XSS? ● What attack surface will remain? ● Will it make a difference?
- 7. Exploits ● Three Chapters to be presented ● Chapter 1: These simple tricks ● Chapter 2: Advanced Class ● Chapter 3: For Science!
- 8. Chapter one [ These simple Tricks ]
- 9. CAPCTHA Of Doom ● Seems legit? ● See it live: http://heideri.ch/opera/captcha/
- 10. Analysis ● What really happens ● The attacker, Clive, injects CSS... – input[type=password]{content:attr(value)} ● Then he includes a custom SVG font – @font-face {font-family: X;src: url(x.svg#X) format("svg");} ● The attacker simply flips characters – s becomes x, e becomes w, c becomes @ … ● By thinking it's a CAPTCHA... ● … Alice submits her password to the attacker
- 11. Validation
- 12. CSS + RegEx = ? ● Old but gold – brute-forcing passwords ● But this time with CSS3 and HTML5 ● The secret ingredient here is „validation“ ● Brute-force with RegEx! ● Let's have a look ● DEMO ● Good thing it works on all browsers ● Limited by smart password managers though
- 13. Chapter TWO < Advanced Class >
- 14. SVG Keylogger ● Just a harmless login page ● Behaving strange on closer inspection though... ● Let's check that http://html5sec.org/keylogger
- 15. How is it done? ● Attacker injected some inline SVG code ● SVG knows the <set> element ● The <set> element can listen to events ● Even keystrokes ● The feature is called accessKey() (W3C) ● JavaScript is turned off – it's „no script“ anyway ● But the keystroke scope is hard to define ● In Firefox it's the whole document
- 16. CSS + URL + Regex = ? ● More info we can steal ● CSS3 and @document ● Allows to cast a Regex on the loaded URL ● Then deploy custom CSS ● We can steal stuff now ● But we can do even more ;) ● http://html5sec.org/xssfilter/ ● Is that all? ● Maybe not
- 17. More Madness ● HTML5's dirname attribute ● The most useless attribute ever ● Worse than formaction... which one should know or look up :) ● Meant to tell the server about... *drumroll* ● Text-Flow Direction! ● Also does cruel things to HTTP requests ● DEMO
- 18. Chapter Three < For Science! >
- 19. CSRF Tokens ● Everybody knows CSRF ● One domain makes a request to another ● The user is logged into that other domain ● Stuff happens, accounts get modified etc. ● How to we kill CSRF? ● Easily – we use tokens, nonces ● We make sure a request cannot be guessed ● Or brute-forced – good tokens are long and safe
- 20. CSRF and XSS ● CSRF and XSS are good friends ● JavaScript can read tokens from the DOM ● Bypass most CSRF protection techniques ● But can we steal CSRF tokens w/o JS?
- 21. Already done ● SDC, Gaz and thornmaker already did it ● Check out http://p42.us/css/ ● They used CSS ● Basically a brute-force via attribute selectors ● input[value^=a]{background:url(?a)} ● If the server catches GET /?a... ● The first character is an a ● But then what? ● There's no „second or Nth character selector“ ● They had to go input[value^=aa]{background:url(?aa)}
- 22. Ingredients ● Some links with a secret CSRF token ● A CSS injection ● height ● width ● content:attr(href) ● overflow-x:none ● font-family ● And another secret ingredient
- 23. DEMO ● http://html5sec.org/webkit/test
- 24. The Magic Part ● The secret ingredients ● Custom SVG font – one per character ● An animation – decreasing the box size ● The overflow to control scrollbar appearance ● And finally... ● Styled scrollbar elements – WebKit only div.s::-webkit-scrollbar-track-piece :vertical:increment {background:red url(/s)}
- 25. Those Fonts ● There's more we can do with custom fonts ● HTML5 recommends WOFF ● All done via @font-face ● WOFF supports an interesting feature ● Discretionary Ligatures ● Arbitrary character sequences can become one character ● Imagine.. C a t become a cat icon. Or... d e e r a lil' deer
- 26. Ligatures ● http://ie.microsoft.com/testdrive/graphics/opentype/opentype-monotype/index.html
- 27. Fontforge
- 28. Attack Fonts ● We can thus build dictionary fonts! ● One character per password for example ● No problem for a font to handle 100k+ items ● Map the string s u p e r s e c r e t into one char ● Make everything else invisible ● If the character is visible, we have a hit ● If not the password is not in the list/font ● How can we find out if nothing – or just one character is visible?
- 29. Go CSS! ● Remember the smart scrollbars? ● Same thing all over again ● But this time for all browsers please ● CSS Media Queries to the rescue! ● We can deploy selective CSS depending on: – Viewport width, viewport height – @media screen and (max-width: 400px){*{foo:bar}} ● Every character gets a distinct width, and/or height ● Once scrollbars appear, the viewport width gets reduced ● By the width of the scrollbar ● Some Iframe tricks do the job and allow universal scrollbar detection ● That's all we need _:D
- 30. Demo DEMO
- 31. Conclusion ● Scriptless Attacks versus XSS ● Not many differences in impact ● More common injection scenarios ● Affecting sandboxes with HTML5 ● Information leaks by design ● Hard to detect and fix ● Timing and Side-Channel ● NoScript to the rescue?
- 32. Defense ● How to protect against features? ● How to protect against side-channels ● Reduce data leakage? ● Build better sandboxes? ● Extend SOP to images and other side channels, ● CSP maybe? One day? ● XFO and Frame-Busters ● Better CSS filter tools are needed! ● Know your spec, contribute!
- 33. Fin ● Questions? ● Discussion? ● Please read our Paper and... ● Thanks for your time!