1 Feross Aboukhadijeh

CS 253: Web Security
1 Feross Aboukhadijeh
Administrative Stuff
• Website: cs253.stanford.edu
• 5-6 assignments
• 7-8 guest lectures
• Use Piazza for questions
• Share anonymous feedback (use form on website)
• Assignment 0 released tonight
Origins of this course
• CS 241: Secure Web Programming
• Last taught in 2011 by Dan Boneh and John Mitchell
• My favorite class at Stanford
• Inspired me to start looking for vulnerabilities
• I wanted to bring back the course – that's what CS 253 is!
Some stories
Every site can store 5 MB
1.filldisk.com
2.filldisk.com
3.filldisk.com
4.filldisk.com
5.filldisk.com
6.filldisk.com
7.filldisk.com
... and so on ...
Goal #1
The attacker mindset
Goal #2
The defender mindset
Extra credit policy
• Anyone who finds a web security vulnerability during the quarter
will receive extra credit (1 to 50 points)
• YOU MUST USE RESPONSIBLE DISCLOSURE
• If Stanford web app, must use Stanford Bug Bounty program
• Do not attack servers you do own, do not destroy data
• You are responsible for your own actions
• If you are unsure, come speak with us
Why is computer security hard?
• Lots of buggy code
• Social engineering is very effective
• There's money to be made by finding and exploiting vulnerable
systems
• Marketplace for vulnerabilities
• Marketplace for owned machines / stolen data
• Many methods to profit from owned machines / stolen data
Why attack a computer system?
• Spam
• Sent from legitimate IP address, less likely to be blocked
• Denial of service
• Attack competitors, or seek ransom
• Infect visiting users with malware
• Infect one server, use it to infect hundreds of thousands of clients
• Data theft
• Steal credentials, credit card numbers, intellectual property
14 Source: California Breach Notification Report, 2016
Why attack a computer system in
2019?
• Mine cryptocurrency
• Ransomware
• Political motivation
What is web security?
• Browser security
• e.g. Same Origin Policy – Isolate sites from each other, while
running in the same browser
• Server app security
• Attackers can run arbitrary HTTP clients; can send anything to
server
curl
-d '{"user":"Alice", "permission":"admin"}'
-H "Content-Type: application/json"
-X POST http://example.com/data
• Client app security
• Prevent user from being attacked while using web app locally
Creates a new admin user with these credentials:
• Username: wpservices
• Password: w0rdpr3ss
• Protect the user
• From social engineering
• From trackers, private data being leaked
Why is web security hard?
• Extremely ambitious goal – Run untrusted code securely
• Different sites interacting in the same tab ("mashups")
• Low-level features; hardware access
• Desire for high performance
• APIs were not designed from first principles; evolved
• Strict backwards compatibility requirements
• "Don't break the web"
"Modern web applications are built on a tangle of technologies that
have been developed over time and then haphazardly pieced together.
Every piece of the web application stack, from HTTP requests to
browser-side scripts, comes with important yet subtle security
consequences. To keep users safe, it is essential for developers to
confidently navigate this landscape."
– Tangled Web
The browser has a seemingly impossible task
Sites – even malicious ones – can:
• Download content from anywhere

• Spawn worker processes
• Open sockets to a server, or even to another user's browser
• Display media in a huge number of formats
• Run custom code on the GPU
• Save/read data from the filesystem
Differing visions for the web
• Simple document viewer?
• Powerful application platform?
The web is robust
"It's is all too easy to criticize, lament, and create paranoid scenarios
about the 'unsound security foundations' of the web. Truth is, all of
that criticism is true, and yet the web has proven to be an incredibly
robust platform."
– Ilya Grigorik, Google web performance engineer
Goal #3
Learn to architect
secure systems
This course
• Part 1: Browser security model, Same origin policy
• Part 2: Client security: attacks, defense
• Part 3: Server security: attacks, defense, authentication, TLS
• Part 4: Writing secure code
HTML
Introduction
This article is a review of the book Dietary Preferences of Penguins, by Alice

Jones and Bill Smith. Jones and Smith's controversial work makes three
hard-to-swallow claims about penguins:
First, that penguins actually prefer tropical foods such as bananas and
pineapple to their traditional diet of fish
Second, that tropical foods give penguins an odor that makes them unattractive
to their traditional predators
<h1>Introduction</h1>
<p>
This article is a review of the book Dietary Preferences of Penguins, by Alice
Jones and Bill Smith. Jones and Smith's controversial work makes three
hard-to-swallow claims about penguins:
</p>
<ul>
<li>
First, that penguins actually prefer tropical foods such as bananas and
pineapple to their traditional diet of fish
</li>
<li>
Second, that tropical foods give penguins an odor that makes them
unattractive to their traditional predators
</li>
</ul>
<!doctype html>
<html lang='en'>
<head>
<meta charset='utf-8' />
<title>Dietary Preferences of Penguins</title>
</head>
<body>
<h1>Introduction</h1>
<p>
This article is a review of the book Dietary Preferences...
</p>
</body>
</html>
Uniform Resource Locators (URLs)
Ways to specify a URL
• Full URL: <a href='http://stanford.edu/news/2019/'>2019 News</a>
• Relative URL: <a href='september'>September News</a>
• Same as http://stanford.edu/news/2019/september
• Absolute URL: <a href='/events'>Events</a>
• Same as http://stanford.edu/events
• Fragment URL: <a href='#section3'>Jump to Section 3</a>
• Scrolls to <a name='section3' /> within page
• Same as http://stanford.edu/events#section3
Lots of HTML tags
• <img>
• <video>, <audio>
• <canvas>
• <link>, <style>
• <script>
Include CSS in a page

<link rel='stylesheet' href='/path/to/styles.css' />


<style>
body {
color: hot-pink;
}
</style>
Include JavaScript in a page

<script src='/path/to/script.js'></script>


<script>
window.alert('hi there!')
</script>
JavaScript
• Fun
• Flexible
• Immediate feedback
• Pre-installed on every device in the world
• Dev environment is pre-installed too, so easy to start writing code
Node.js
• JavaScript on the command line
• Adds built-in functions for filesystem, HTTP, DNS, and sockets
• Stuff that belongs in a scripting language, but not a browser
• Also adds module system, binary data support
• Less necessary because JavaScript has improved rapidly
"JavaScript APIs"
• "JavaScript APIs" can come from:
• JavaScript language specification
• Document Object Model specification (browser)
• Node.js built-ins
• Examples:
• Array
• document.createElement
• fs.readFile
Crusty browser APIs
• window.open()
• window.moveTo()
• window.resizeTo()
Demo: Window breakout game
END

1 Feross Aboukhadijeh

Uploaded by

Copyright:

Available Formats

1 Feross Aboukhadijeh

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1 Feross Aboukhadijeh

Uploaded by

Copyright:

Available Formats

CS 253: Web Security

Sites – even malicious ones – can:

• Download content from anywhere

This article is a review of the book Dietary Preferences of Penguins, by Alice

You might also like