cse 484 / cse m 584: computer security and privacy ssl/tls · ssl/tls • secure sockets layer and...
TRANSCRIPT
CSE484/CSEM584:ComputerSecurityandPrivacy
SSL/TLS
Fall2016
Ada(Adam)[email protected]
ThankstoFranziRoesner,DanBoneh,DieterGollmann,DanHalperin,YoshiKohno,JohnManferdelli,JohnMitchell,VitalyShmatikov,BennetYee,andmanyothersforsampleslidesandmaterials...
Wehaveallthepieces!
• SymmetricEncryption(privacy!)• MACs(integrity!)• AsymmetricCrypto(bootstrapping!)• CertificateAuthorities(authenticity!)
11/4/16 CSE484/CSEM584-Fall2016 2
SSL/TLS
• SecureSocketsLayerandTransportLayerSecurity– Sameprotocol,newversion(TLSiscurrent)
• DefactostandardforInternetsecurity– “TheprimarygoaloftheTLSprotocolistoprovide
privacyanddataintegritybetweentwocommunicatingapplications”
• DeployedineveryWebbrowser;alsoVoIP,paymentsystems,distributedsystems,etc.
11/4/16 CSE484/CSEM584-Fall2016 3
SSL/TLS
• TLSistypicallyusedontopofaTCPconnection
TLS
• Canbeusedoverothertransportprotocols
11/4/16 CSE484/CSEM584-Fall2016 4
TLSBasics
• TLSconsistsoftwoprotocols– Familiarpatternforkeyexchangeprotocols
• Handshakeprotocol– Usepublic-keycryptographytoestablishasharedsecretkeybetweentheclientandtheserver
• Recordprotocol– Usethesecretsymmetrickeyestablishedinthehandshakeprotocoltoprotectcommunicationbetweentheclientandtheserver
11/4/16 CSE484/CSEM584-Fall2016 5
BasicHandshakeProtocol
11/4/16 CSE484/CSEM584-Fall2016 6
C
ClientHello
S
Clientannounces(inplaintext):• Protocolversionitisrunning• Cryptographicalgorithmsitsupports• Fresh,randomnumber
BasicHandshakeProtocol
11/4/16 CSE484/CSEM584-Fall2016 7
C
C,versionc,suitesc,Nc
ServerHello
SServerresponds(inplaintext)with:• Highestprotocolversionsupportedby
boththeclientandtheserver• Strongestcryptographicsuiteselected
fromthoseofferedbytheclient• Fresh,randomnumber
BasicHandshakeProtocol
11/4/16 CSE484/CSEM584-Fall2016 8
C
versions,suites,Ns,ServerKeyExchange
SServersendsitspublic-keycertificatecontainingeitheritsRSA,orhisDiffie-Hellmanpublickey(dependingonchosencryptosuite)
C,versionc,suitesc,Nc
BasicHandshakeProtocol
11/4/16 CSE484/CSEM584-Fall2016 9
C
versions,suites,Ns,certificate,“ServerHelloDone”
S
C,versionc,suitesc,Nc
ClientKeyExchange
Theclientgeneratessecretkeymaterialandsendsittotheserverencryptedwiththeserver’spublickey(ifusingRSA)
BasicHandshakeProtocol
11/4/16 CSE484/CSEM584-Fall2016 10
C
versions,suites,Ns,certificate,“ServerHelloDone”
S
C,versionc,suitesc,Nc
{Secretc}PKsifusingRSA
switchtokeysderivedfromsecretc,Nc,Ns
CandSsharesecretkeymaterial(secretc)atthispoint
switchtokeysderivedfromsecretc,Nc,Ns
FinishedFinished
Recordofallsentandreceivedhandshakemessages
“Core”SSL3.0Handshake(NotTLS)
11/4/16 CSE484/CSEM584-Fall2016 11
C
versions=3.0,suites,Ns,certificate,“ServerHelloDone”
S
C,versionc=3.0,suitesc,Nc
{Secretc}PKsifusingRSA
switchtokeysderivedfromsecretc,Nc,Ns
CandSsharesecretkeymaterial(secretc)atthispoint
switchtokeysderivedfromsecretc,Nc,Ns
FinishedFinished
VersionRollbackAttack
11/4/16 CSE484/CSEM584-Fall2016 12
C
Versions=2.0,suites,Ns,certificate,“ServerHelloDone”
S
C,versionc=2.0,suitesc,Nc
{Secretc}PKsifusingRSA
CandSendupcommunicatingusingSSL2.0(weakerearlierversionoftheprotocolthat
doesnotinclude“Finished”messages)
ServerisfooledintothinkingheiscommunicatingwithaclientwhosupportsonlySSL2.0
“Chosen-Protocol”Attacks
• Whydopeoplereleasenewversionsofsecurityprotocols?Becausetheoldversiongotbroken!
• Newversionmustbebackward-compatible– Noteverybodyupgradesrightaway
• Attackercanfoolsomeoneintousingtheold,brokenversionandexploitknownvulnerability– Similar:foolvictimintousingweakcryptoalgorithms
• Defenseishard:mustauthenticateversioninearlydesigns• Manyprotocolshavehad“versionrollback”attacks
– SSL,SSH,GSM(cellphones)
11/4/16 CSE484/CSEM584-Fall2016 13
VersionCheckinSSL3.0
11/4/16 CSE484/CSEM584-Fall2016 14
C
versions=3.0,suites,Ns,certificateforPKs,“ServerHelloDone”
S
C,versionc=3.0,suitesc,Nc
{versionc,secretc}PKs
CandSsharesecretkeymaterialsecretcatthispoint
“Embed”versionnumberintosecret
CheckthatreceivedversionisequaltotheversioninClientHello
switchtokeyderivedfromsecretc,Nc,Ns
switchtokeyderivedfromsecretc,Nc,Ns
Network
WebSecurity!BigPicture:BrowserandNetwork
11/4/16 CSE484/CSEM584-Fall2016 15
Browser
OS
Hardware
websiterequest
reply
ThebrowserrendersorexecutesarbitraryHTML,CSS,andJavascriptsendbyhostsontheInternet.
WhereDoestheAttackerLive?
11/4/16 CSE484/CSEM584-Fall2016 16
Network
Browser
OS
Hardware
websiterequest
replyWeb
attacker
Networkattacker
Malwareattacker
AllofTheseShouldBeSafe
• Safetovisitanevilwebsite
• Safetovisittwopagesatthesametime
• Safedelegation
11/4/16 CSE484/CSEM584-Fall2016 17
BuildingBlocksoftheWeb(andWebSecurity)
• HTTP(S)• Cookies
11/4/16 CSE484/CSEM584-Fall2016 18
HTTP:HyperTextTransferProtocol
• Applicationlayerprotocolusedbybrowsersandwebservers
• Statelessrequest/responseprotocol– Eachrequestisindependentofpreviousrequests
– Statelessnesshasasignificantimpactondesignandimplementationofapplications
11/4/16 CSE484/CSEM584-Fall2016 19
HTTPRequest
11/4/16 CSE484/CSEM584-Fall2016 20
GET /default.asp HTTP/1.0 Accept: image/gif, image/x-bitmap, image/jpeg, */* Accept-Language: en User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Connection: Keep-Alive If-Modified-Since: Sunday, 17-Apr-96 04:32:58 GMT
Method File HTTP version Headers
Data – none for GET Blank line
HTTPResponse
11/4/16 CSE484/CSEM584-Fall2016 21
HTTP/1.0 200 OK Date: Sun, 21 Apr 1996 02:20:42 GMT Server: Microsoft-Internet-Information-Server/5.0 Connection: keep-alive Content-Type: text/html Last-Modified: Thu, 18 Apr 1996 17:39:05 GMT Content-Length: 2543 <HTML> Some data... blah, blah, blah </HTML>
HTTP version Status code Reason phrase Headers
Data
HTTPVerbs
• HTTPdeclaresanumberof“verbs”thatclientscanusetorequestorprovideinformation– GETasksforaresource– POSTsendsinformation– HEADgetsmetadata(headers)foraresource
– Also:PUT,DELETE,TRACE,OPTIONS,CONNECT,PATCH
11/4/16 CSE484/CSEM584-Fall2016 22
HTTPResources
• URLstandsforUniformResourceLocator• Specifiesthelocationofaresourceonanetwork–whatserverisiton,whereisitonthatserver?
• ResourcescouldincludeHTMLpages,images,data,etc.
11/4/16 CSE484/CSEM584-Fall2016 23
HTTPVerbs
• HTTPdeclaresanumberof“verbs”thatclientscanusetorequestorprovideinformation– GETasksforaresource– POSTsendsinformation– HEADgetsmetadata(headers)foraresource
– Also:PUT,DELETE,TRACE,OPTIONS,CONNECT,PATCH
11/4/16 CSE484/CSEM584-Fall2016 24
HTTPVerbs
• HTTPdeclaresanumberof“verbs”thatclientscanusetorequestorprovideinformation– GETasksforaresource(Givemethisimage)– POSTsendsinformation– HEADgetsmetadata(headers)foraresource
– Also:PUT,DELETE,TRACE,OPTIONS,CONNECT,PATCH
11/4/16 CSE484/CSEM584-Fall2016 25
HTTPVerbs
• HTTPdeclaresanumberof“verbs”thatclientscanusetorequestorprovideinformation– GETasksforaresource(Givemethisimage)– POSTsendsinformation(Iwanttologin)– HEADgetsmetadata(headers)foraresource
– Also:PUT,DELETE,TRACE,OPTIONS,CONNECT,PATCH
11/4/16 CSE484/CSEM584-Fall2016 26
HTTP:HyperTextTransferProtocol
• Applicationlayerprotocolusedbybrowsersandwebservers
• Statelessrequest/responseprotocol– Eachrequestisindependentofpreviousrequests
– Statelessnesshasasignificantimpactondesignandimplementationofapplications
11/4/16 CSE484/CSEM584-Fall2016 27
Cookies–StatefulnessforHTTP
11/4/16 CSE484/CSEM584-Fall2016 28
Acookieisafilecreatedbyawebsitetostoreinformationinthebrowser
BrowserServer
POSTlogin.cgiusernameandpwd
BrowserServer
GETrestricted.html
Cookie:userID=Alice
HTTPisastatelessprotocol;cookiesaddstate
HTTPHeader:Set-cookie: userID=Alice;
CookieFormat
• CookiesarejustKEY=VALUEpairs,e.g.,– language=ENGLISH – userID=Alice – sessionID= 8113d906-62e8-49e1-80e1-65805cb51cab
– adID= 9c740c60-8d88-4da6-bb83-041e95c1efac
11/4/16 CSE484/CSEM584-Fall2016 29
Cookies–StatefulnessforHTTP
11/4/16 CSE484/CSEM584-Fall2016 30
Acookieisafilecreatedbyawebsitetostoreinformationinthebrowser
BrowserServer
POSTlogin.cgiusernameandpwd
BrowserServer
GETrestricted.html
Cookie:NAME=VALUE
HTTPisastatelessprotocol;cookiesaddstate
Ifexpires=NULL,thissessiononly
HTTPHeader:Set-cookie: NAME=VALUE;
domain=(whocanread);expires=(whenexpires);secure=(sendonlyoverHTTPS)
WhatAreCookieUsedFor?
• Personalization– Websiteremembersvisitorpreferences– language=ENGLISH
• Authentication– Thecookie“proves”clientisloggedin– sessionID=8113d906-62e8...
• Tracking– Followtheuserfromsitetosite;– adID=9c740c60-8d88…
11/4/16 CSE484/CSEM584-Fall2016 31
GoalsofWebSecurity
• SafelybrowsetheWeb– Amaliciouswebsitecannotstealinformationfromor
modifylegitimatesitesorotherwiseharmtheuser…– …evenifvisitedconcurrentlywithalegitimatesite--in
aseparatebrowserwindow,tab,oreveniframeonthesamewebpage
• SupportsecureWebapplications– ApplicationsdeliveredovertheWebshouldhavethe
samesecuritypropertieswerequireforstandaloneapplications
11/4/16 CSE484/CSEM584-Fall2016 32
AllofTheseShouldBeSafe
• Safetovisitanevilwebsite
• Safetovisittwopagesatthesametime
• Safedelegation
11/4/16 CSE484/CSEM584-Fall2016 33
TwoSidesofWebSecurity
• Webbrowser– ResponsibleforsecurelyconfiningWebcontentpresentedbyvisitedwebsites
• Webapplications– Onlinemerchants,banks,blogs,GoogleApps…– Mixofserver-sideandclient-sidecode
• Server-sidecodewritteninPHP,Ruby,ASP,JSP…runsontheWebserver
• Client-sidecodewritteninJavaScript…runsintheWebbrowser
– Manypotentialbugs:XSS,XSRF,SQLinjection
11/4/16 CSE484/CSEM584-Fall2016 34
WhereDoestheAttackerLive?
11/4/16 CSE484/CSEM584-Fall2016 35
Network
Browser
OS
Hardware
websiterequest
replyWeb
attacker
Networkattacker
Malwareattacker
Attackermaycontrol1ormoredomainsorwebsites
AttackergetstorunJavascriptandHTMLcodeinthebrowser
Attackercanmakemaliciousrequeststowebservers–canevenuseHTML/JStomakethoserequestsFromusers’browsers!
WebAttacker
• Controlsamaliciouswebsite(attacker.com)– CanobtainanTLScertificateforattacker.com
• Uservisitsattacker.com–why?– Phishingemail,enticingcontent,searchresults,placedbyanadnetwork,blindluck…
– Or,attacker.comisembeddedonanotherpage–loadingthefriendlypageloadscontentfromattacker.com
11/4/16 CSE484/CSEM584-Fall2016 36
WebAttacker
11/4/16 CSE484/CSEM584-Fall2016 37
www.attacker.com
Javascript,or,SoftwareSecurityfortheWeb! <html> … <p> The script on this page is totally trustworthy <script>
doSomethingEvil() </script> … </html>
11/4/16 CSE484/CSEM584-Fall2016 38
Browserreceivescontent,displaysHTMLandexecutesscripts
Apotentiallymaliciouswebpagegetstoexecutesomecodeonuser’smachine!
www.attacker.com
BrowserSandbox
• Goal:safelyexecuteJavaScriptcodeprovidedbyawebsite– No/limitedaccesstoOS/network/filesystem/browserdata.
– Nobufferoverflows,nowaytoexecutearbitrarynativecode,processisolationbetweentabs
– Attackershouldn’tbeabletoaccessdatafromothertabsorbrowserwindows
– attacker.comshouldn’tbeabletoaccessdatafrombank.com,evenifyou’reloggedin
11/4/16 CSE484/CSEM584-Fall2016 39
AStrawpersonAttack
www.attacker.com
www.bank.com(e.g.,
balance:$500)
www.attacker.com(theparent)cannotaccessHTMLelementsin
theiframe(andviceversa).
11/4/16 CSE484/CSEM584-Fall2016 40
Same-OriginPolicy:DOM
OnlycodefromsameorigincanaccessHTMLelementsonanothersite(orinaniframe).
www.example.com
www.example.com/iframe.html
www.evil.com
www.example.com/iframe.html
www.example.com(theparent)canaccessHTMLelementsintheiframe
(andviceversa).
www.evil.com(theparent)cannotaccessHTMLelementsintheiframe
(andviceversa).11/4/16 CSE484/CSEM584-Fall2016 41
Same-OriginPolicy
Websiteorigin=(scheme,domain,port)
[ExamplethankstoWikipedia.]11/4/16 CSE484/CSEM584-Fall2016 42