When the CDN goes bananas
•
1 j'aime•635 vues
How to protect your website assets with Subresource Integrity The slides were first presented on the SecTalks Sydney Meetup: http://www.meetup.com/SecTalks/events/228854146/
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à When the CDN goes bananas
Similaire à When the CDN goes bananas (20)
Plus de Gabor Szathmari
Plus de Gabor Szathmari (13)
Dernier
Dernier (20)
When the CDN goes bananas
- 1. WHEN THE CDN GOES BANANAS SUBRESOURCE INTEGRITY
- 2. WHEN THE CDN GOES BANANAS me_irl • Gabor Szathmari • Information Security Professional Hacker Freelancer • Privacy Advocate
- 3. WHEN THE CDN GOES BANANAS I WILL BE TALKING ABOUT • JavaScript hosted by third-parties • Some scary bits • The Solution: Subresource Integrity ‣ What it does ‣ Tooling
- 4. THIRD-PARTY CODE ON MODERN WEBSITES
- 5. ANALYTICS
- 6. A/B TESTING
- 7. HEATMAPS
- 8. TAG MANAGERS
- 9. PRIVATE CDN
- 10. PUBLIC CDN
- 12. WHEN THE CDN GOES BANANAS MODERN WEBSITES • Third-party JavaScript (heatmaps, user tracking, analytics …) • Public CDNs (jsDelivr, ajax.googleapis.com, ajax.aspnetcdn.com …) • Private CDNs (S3, Akamai, CloudFront, Fastly …)
- 13. “YOU KNOW WHAT THEY SAY: LOVE* IS BLIND”* <script src=“”>
- 16. WHAT CAN GO WRONG?
- 17. WHEN THE CDN GOES BANANAS MODERN WEBSITES • Third-party JavaScript (heatmaps, user tracking, analytics …) • Public CDNs (jsDelivr, ajax.googleapis.com, ajax.aspnetcdn.com …) • Private CDNs (S3, Akamai, CloudFront, Fastly …) HACKED
- 19. WHEN THE CDN GOES BANANAS 🙀 🙀 🙀 • https://www.maxcdn.com/blog/bootstrapcdn-security-post-mortem/ • https://blog.pagefair.com/2015/halloween-security-breach/ • https://citizenlab.org/2015/04/chinas-great-cannon/ • http://securityaffairs.co/wordpress/31480/cyber-crime/afghanistan- cdn-network-hacked.html • https://medium.com/@FredericJacobs/the-reuters-compromise-by- the-syrian-electronic-army-6bf570e1a85b
- 22. WHEN THE CDN GOES BANANAS WHAT IS THE DAMAGE? • Unwanted redirection • Website defacement • Click fraud • Exploit kits (ransomware) • Cookie stealing, session hijacking • Keylogging • UI redressing (password stealing, OTP stealing)
- 24. WHAT CAN WE DO?
- 32. WHEN THE CDN GOES BANANAS BROWSER SUPPORT
- 33. WHEN THE CDN GOES BANANAS
- 34. TOOLING
- 35. MANUAL HASHING
- 36. WHEN THE CDN GOES BANANAS OPENSSL • openssl dgst -sha256 -binary jquery.min.js | openssl base64 -A • openssl dgst -sha384 -binary jquery.min.js | openssl base64 -A • openssl dgst -sha512 -binary jquery.min.js | openssl base64 -A
- 37. WHEN THE CDN GOES BANANAS OPENSSL • $ curl -s https://code.jquery.com/jquery-2.2.3.min.js | openssl dgst -sha512 -binary | openssl base64 -A SFaNb3xC08k/Wf6CRM1J+O/vv4YWyrPBSdy0o+1nqKzf +uLrIBnaeo8aYoAAOd31nMNHwX8zwVwTMbbCJjA8Kg== • <script src=“https://code.jquery.com/jquery-2.2.3.min.js” integrity=“sha512-SFaNb3xC08k/Wf…” […]
- 38. HOSTED TOOLS
- 40. CMS
- 41. WHEN THE CDN GOES BANANAS PLUGINS • WordPress https://wordpress.org/plugins/wp-sri/ • Drupal https://www.drupal.org/project/advagg
- 43. WHEN THE CDN GOES BANANAS WORKFLOW INTEGRATION
- 44. WHEN THE CDN GOES BANANAS WORKFLOW INTEGRATION
- 45. SCAN YOUR WEBSITE FOR SRI USAGE
- 46. SRITEST.IO
- 47. SRITEST.IO
- 48. WHEN THE CDN GOES BANANAS TOOLING • Manual • Hosted • CMS Plugins • Workflow Integration • sritest.io
- 49. WHEN THE CDN GOES BANANAS SUMMARY • Modern websites rely on JS/CSS • Hosted on CDNs / at third-parties • SRI protects from unexpected JS/CSS changes • Tooling is available
- 50. WHEN THE CDN GOES BANANAS FURTHER READING • https://www.owasp.org/index.php/ 3rd_Party_Javascript_Management_Cheat_Sheet • http://j.mp/cdn-goes-bananas • http://j.mp/new-sri2-features ‣ Enforce SRI with CSP ‣ Violation Reporting
- 51. WHEN THE CDN GOES BANANAS THANK YOU• @gszathmari • PGP: keybase.io/gszathmari