frenemies - owasp · 2013. 10. 8. · tweet your questions #ns4dev. frenemies: noscript for web...
TRANSCRIPT
![Page 1: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/1.jpg)
Frenemies
NoScript vs for Web Developers
![Page 2: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/2.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
about:me
✔Giorgio Maone (@ma1)
✔ Software developer & hacker
✔Code Contributor & Security Group member @ Mozilla
✔WASWG invited expert @ W3C
✔#9 @ “Most Dangerous People on the Internet ” (© RSnake)
✔Dad, most of the time @ Home
✔Creator & maintainer of the NoScript browser add-on
![Page 3: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/3.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
about:NoScript
✔ JavaScript permission manager
✔Embedded content blocker (plugins, media...)
✔XSS filter
✔Application Boundaries Enforcer (ABE)
✔ClearClick (Clickjacking protection)
✔HTTPS enhancements
✔Usability helpers
✔ ...
![Page 4: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/4.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
about:talk
✔Good practices appraisal
✔Cheap tricks shaming
✔Usability extras showcase
✔ Future directions
✔Help & feedback requests
![Page 5: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/5.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Tweet your questions
#ns4dev
![Page 6: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/6.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Flexible Permissionsfor
JavaScript and
Embedded ContentJava, Flash, Silverlight, Acrobat Reader and any other plugin,
HTML5 media (<video>, <audio>, APIs),WebGL, XSLT, Web Fonts,
Frames (optionally)
![Page 7: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/7.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Interlude...
![Page 8: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/8.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
WTF?WTF?
![Page 9: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/9.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Main use cases for this mess
✔Content mash-ups
✔CDNs
✔External trackers/analytics
✔Advertisement networks
✔… add yours #ns4devMess
![Page 10: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/10.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Keep it tight
✔Depend on just 1 domain...
✔… or use subdomains
✔Sharding is less important nowadays
✔cloudfront.net raw inclusions suck
![Page 11: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/11.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Meet middle-click (or shift+click)
![Page 12: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/12.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Keep it visible
✔Be clear about required/optional
✔Take advantage of placeholders
✔“Enable JavaScript” redirected page is EVIL
✔Avoid nested inclusions
✔cloudfront.net raw inclusions suck!
![Page 13: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/13.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Poor man CDNs OMG!✔ “Cheap” setups like including jQuery plugins from their code
repositories get mercilessly broken by NoScript
✔NoScript blocks script and CSS inclusions with download-specific content-type headers and/or Content-disposition: attachment
✔This should be mandatory in any browser (even without X-Content-Type-Options: nosniff)
✔Very important to NoScript users (github, googlecode...)
![Page 14: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/14.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Less Painful Script Blocking?
✔Attempt to “fix” JavaScript navigation (links, drop-down menus, submit buttons, redirections)
✔ Framebusting emulation
✔ Forcing <NOSCRIPT> elements visible for blocked inclusions
✔ Lots of other minor stuff, but most important...
![Page 15: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/15.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Script Surrogates
✔ Similar to GreaseMonkey scripts but different :)
✔Blocking aware (triggered also by inclusion blocking)
✔Can modify the execution environment, emulating missing scripts and even built-in objects
✔Can replace remote scripts with local alternatives (RFE by Richard Stallman)
✔ hackademix.net/2011/09/29/script-surrogates-quick-reference/
![Page 16: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/16.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Abusive Ideas
✔Abusing “Stallman's” surrogates to cache jQuery and other common libraries locally
✔Abusing WHOIS to create “batch allow” groups
✔Abusing (?) data- attributes on <SCRIPT> elements to provide useful metadata
✔Tweet your #ns4devIdea
![Page 17: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/17.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Anti-XSS Filter
✔ (Ab)uses Gecko's HTML parser and the SpiderMonkey JavaScript engine to check for suspicious payloads
✔Desktop version filters / Android version blocks
✔Checks for many “exotic” encodings and complex attack scenarios (e.g. Ebay's custom URL encoding, omographic attacks, multiple omomimous parameters concatenations...)
✔Examines thoroughly the request, but ignores the response (pro: safest; con: more false positives)
![Page 18: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/18.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
XSS false positives
...as seen on Youtube!
![Page 19: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/19.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Please post data, not code
✔Avoid fancy cross-site POSTs (and GETs!)
✔JSON & XML are OK
✔JavaScript & HTML are bad
✔Base64 “obfuscation” is useless
![Page 20: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/20.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
HTTPS Enhancements
✔Automatic or manual cookie management (against “Cookie Monster” attacks on badly implemented HTTPS sites)
✔HTTPS enforcing
✔HTTPS-dependent permissions (with TOR-specific setting)
![Page 21: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/21.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
HTTPS Enhancements
TriviaEFF's HTTPS Everywhere mostly reuses
NoScript's HTTPS enforcing code
![Page 22: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/22.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
HTTPS Enhancements
Developer Advices
✔Avoid bouncing back user to HTTP
✔Use HSTS
![Page 23: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/23.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Application Boundaries Enforcer (ABE)
✔A Web Application Firewall in a browser
✔The advantage of more context (e.g. origin or DOM)
✔Anti-CSRF
✔Resistant to DNS-rebinding
✔Default rule to block cross-zone request, protects LAN and local resources such as SOHO firewalls
✔noscript.net/abe
![Page 24: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/24.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Application Boundaries Enforcer (ABE)
Developer Advices
✔Experiment protecting your own applications
✔Avoid “hotel Wi-Fi” nightmare setups
✔ Live without cross-zone requests
![Page 25: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/25.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
ClearClickthe ClickJacking Killer
![Page 26: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/26.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
ClearClickthe ClickJacking Killer
✔Based on screenshots comparison
✔Additional countermeasures against timing attacks
✔Additional cursorjacking protection
✔Built-in false positive reporting facility
![Page 27: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/27.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
ClearClickthe ClickJacking Killer
Developer Advices
✔Alert your gfx/front-end people
✔Avoid cross-site content overlapping
✔Be careful with CSS filters/translucency on frames
![Page 28: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/28.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
ClearClick UI Securitycoming soon to a browser near you
✔On its way to standardization by the W3C's Web Applications Security Work Group
✔www.w3.org/TR/UISecurity/ (working draft)
✔Extends CSP
✔Opt-in from the embedded content
✔Includes a frame-options directive and a reporting-only mode
![Page 29: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/29.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Future Plans
✔Merging Android and desktop versions
✔Hacking Blink to make a serious NoScript Chrome viable
✔Hacking Firefox OS to make any browser extension (and therefore NoScript) viable
✔NoScript Enterprise Edition
![Page 30: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/30.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Engagement Rules
✔Use noscript.net/forum for usability bug reports, RFEs and general discussions
✔Use private email for any security-sensitive report: anything causing a mismatch between NoScript users' security expectations and reality
✔Please use PGP to encrypt all your security reports
✔Avoid reporting on Facebook, Twitter & C.!
![Page 31: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/31.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Questions?
![Page 32: Frenemies - OWASP · 2013. 10. 8. · Tweet your questions #ns4dev. Frenemies: NoScript for Web Developers - #ns4dev Flexible Permissions for JavaScript and Embedded Content Java,](https://reader035.vdocument.in/reader035/viewer/2022071517/613be027f8f21c0c82693ef2/html5/thumbnails/32.jpg)
Frenemies: NoScript for Web Developers - #ns4dev
Thank You!
✔hackademix.net
✔@ma1
✔noscript.net