Learn, hack!

URL

http://events.ccc.de/congress/2006/Fahrplan/attachments/1161-2006_11_15_23C3.pdf

File name

1161-2006_11_15_23C3.pdf

File size

845.1 KB

MD5

57f7ec250dec8e22fc55485c388c9303

SHA1

f8531e9148d0668e8bcd364fa9bad5d4ed8ec353

A detailed introduction to Cross Site Request Forgery. This talk presents the fundamental cause of this vulnerability class and examples of potential attack consequences. The second half of the talk is devoted to avoiding and countering CSRF: Implementing CSRF proof session handling, transparent retrofitting of legacy applications and methods for client side protection. Cross Site Request Forgery (CSRF, a.k.a. Session Riding) attacks are public at least since 2001. However this class of web application vulnerabilities is rather obscure compared to attack vectors like Cross Site Scripting or SQL Injection. As the trend towards web applications continues and an increasing number of local programs and appliances like firewalls rely on web based frontends, the attack surface for CSRF grows continuously. While being is some cases as dangerous as e.g. Cross Site Scripting, CSRF vulnerabilities are often regarded as negligible. Moreover, this vulnerability class is often simply unknown to some web application developers. Many misconceptions on countering CSRF exist because of this obscurity. The talk will not only show how to avoid XSRF but also how NOT to do it. Furthermore, most presentations on CSRF only address attacks on cookie based session management. This talk will also cover attacks on http authentication, client side SSL and IP/Mac based access control. CSRF is an attack that targets the user rather than the web application. As long as web applications do not take measures to protect their users against this threat, it is important to investigate possibilities to implement client side mechanisms. This talk will cover a new anti-CSRF Firefox Extension, which is currently under development as well as "RequestRodeo" - a client side proxy, which was, to the best of our knowledge, the first client-side solution for protection against XSRF attacks.