BLUEPRINT: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers Mike Ter Louw, V.N. Venkatakrishnan University of Illinois at Chicago IEEE Symposium on Security and Privacy, 2009 1
Outline Cross-site Scripting Overview BLUEPRINT References Overview Specifics Experiment / Results Contributions Weakness / Improvement References 2 2
Trusted vs. Untrusted HTML 3 3
Trusted vs. Untrusted HTML 4 4
Cross-site Scripting (XSS) Code injection into untrusted HTML which exploits client-side browser parsing Hacker injects code into untrusted section, innocent user visits the web page, client browser displays all content, user encounters unintended content / hack JavaScript (HTML, CSS, Java, Flash, etc.) Non-persistent (reflected), Persistent (stored) 5 5
XSS Example http://www.cisco.com/en/US/docs/solutions/Verticals/PCI_Healthcare/PCI_AppD.html#wp1026905 6 6
XSS Example http://www.zdnet.com/blog/security/facebook-vulnerable-to-critical-xss-could-lead-to-malware-attacks/1175 7 7
XSS Example Many web applications also store user preferences in JavaScript variables directly… 8 8
XSS vulnerability found at these domains. www.xssed.com XSS vulnerability found at these domains. Not yet fixed… 9
BLUEPRINT Goals W3C + dev cycle slow. Need solution now! Solution should be transparent to user, support current browsers, no plug-ins, etc. Retain expressiveness of untrusted HTML Do not rely on browser to parse this data! Enable web apps. to create a “blueprint” of untrusted web content free of XSS attacks, bridging divide between app. & browser 10 10
HTML Interpretation Process 11
Document Object Model (DOM) http://www.wdvl.com/Authoring/DHTML/DOM/NS.html http://www.codeguru.com/csharp/csharp/cs_misc/userinterface/article.php/c12267 12
BLUEPRINT Approach model interpreter ( _bp_ ) Reduce browser influence of parsing: HTML, CSS, URI, JavaScript Server encodes chunks as models, Server API uses whitelist to vet models, data encoded w/ syntactically inert chars Transmit encoded data via <code> nodes, so browser ignores them, + script calls to model interpreter ( _bp_ ) 13 13
BLUEPRINT API 14 14
HTML presented to client BLUEPRINT Model HTML presented to client Encoded to… old new 15 15
HTML Interpretation Process _bp_ script + encoded models A, B, C, D, E Normal path: A, B, C, D, E Untrusted data: A, B’, Q, P, E, R 16
Reduce HTML Parser Influence Models encoded in syntactically inert lang: {a,…,z,A,…,Z,0,…,9,/,+,=}* Decode model w/ model interpreter _bp_, link embedded in <head> element Use of DOM API to create elements Original rendering order preserved, models embedded near original location, decoded synchronously as page renders 17 17
BLUEPRINT Model Generator 18
Results 19 19
Contributions W3C / browser development cycle is slow, offers effective XSS defense solution now No required plug-ins, browser, ext., etc., empowers web developers, user benefits Innovative thinking: Web developers bypass browser parsing 20 20
Weaknesses All websites now have to update their libraries of code to use BLUEPRINT… HTML interpretation process may change, especially on embedded browsers Large script (15.6kB) downloaded / cached, How safe is this script? One for each site? Client browser may disable JavaScript Page size overhead due to text encoding 21 21