Riding Someone Else’s Wave with CSRF Sam Shute sam@quantumsecurity.co.nz

Overview What is CSRF What can we use CSRF for Where can we find CSRF How can we defend against CSRF

What is CSRF - Why should I care CSRF, Sea-Surf, XSRF, one-click attacks, session riding. All mean Cross-Site Request Forgery. Sending requests from someone else’s browser, so their browser adds their cookies. Recently removed from the OWASP Top10

What is CSRF – Real Life Examples Penetration test on Friday 80% of our penetration tests uTorrent malware download Gmail contact list theft

What is CSRF - Flow User visits our malicious/infected site The users browser loads the content for our site, including our CSRF attack The users browser sends the request with their cookies

What is CSRF - Example Antonio requests a site we’ve infected, DogMemes.com Antonio’s browser loads the infected page, including our CSRF attack When it comes across our CSRF his browser makes a request to AntoniosBank.com with his cookie, telling his bank to put $10,000 into our account.

What is CSRF - Example

Same-Origin Policy Same-Origin = Same Domain Blocks background requests that come from a different domain. Modern Browsers only

Demo

CSRF Attack 1: Making a Post Simple HTML form Executed through a phishing attack

CSRF Attack 1-2: Making a Post

CSRF Attack 2: Password Change Background Ajax request Executed through an XSS injection

CSRF Attack 3: Privilege Escalation Background Ajax request Executed through an XSS injection

What can we use CSRF for Making posts Changing passwords Privilege escalation Creating accounts Transferring bank funds

Where can we find CSRF Any request that does not pass a CSRF token is probably vulnerable. Looking at forms and ajax requests are always a good place to start.

Defending Yourself against CSRF Logging out when finished with an application Running a script blocker Updating

What doesn’t work to defend against CSRF HTTPS Using only POST requests Secret cookie values Relying on browser-based protections

What does work against CSRF CSRF Tokens Must be unique per user, preferably unique per action. They must be implemented, but more importantly, they must be validated. Check your framework Content-Security-Policy Doesn’t actually stop CSRF. But by declaring a strict CSP you can reduce the attack surface for XSS.

What does work against CSRF – CSRF Tokens

What does work against CSRF – CSRF Tokens

What does work against CSRF – CSRF Tokens

Summary Very easy to exploit Very easy to defend against

Questions?