QUALYS SECURITY CONFERENCE 2012

LAS VEGAS MUNICH LONDON PARIS OCT 25-26 NOV 06 NOV 08 NOV 13

Migang JavaScript Mistakes Using HTML5

Mike Shema Qualys, Inc. Aria Resort & Casino, Las Vegas, October 25th

1 JavaScript, JScript, ECMAScript, *.exe

• Cross-plaorm, vendor-neutral liability

• Easy to use, easier to misuse

• Challenging to maintain

• Achieving peace of mind from piece of code

2 QUALYS SECURITY CONFERENCE 2012

LAS VEGAS MUNICH LONDON PARIS OCT 25-26 NOV 06 NOV 08 NOV 13 try { security() } catch(err) { }

3 let me = count(ways);

jsfunfuzz -- “It has found about 280 bugs in 's JavaScript engine... About two dozen were memory safety bugs that we believe were likely to be exploitable to run arbitrary code.”

http://www.squarefree.com/2007/08/02/introducing-jsfunfuzz/

4 { var Pwn2Own = $money; }

5 MS12-063 Event-Driven, Non-Blocking Vulns

33 Content-Security-Policy vs. XSS

X-CSP: default-src 'self'

X-CSP: default-src 'self' 'unsafe-inline'

34 Content-Security-Policy vs. XSS

X-CSP: default-src 'self'

X-CSP: script-src evil.site

35 Content-Security-Policy vs. DOM XSS

$(document).ready(function() { var x = (window.location.hash.match(/^#([^\/].+)$/)||[])[1]; var w = $('a[name="' + x + '"], [id="' + x + '"]'); });

// This is an unsafe inline event handler var click = $('#main').attr('onclick', 'alert(9)');

// doesn't trigger unsafe-inline var click = $('#main').click(function(e) { alert(9) });

// doesn't trigger unsafe-inline ]var click = $('#main').bind("click", function(e) { alert(9) });

36 On the Other Hand...

• Awesome DoS if CSP headers are absent and XSS vuln is present:

37 Careful with those Improvements

• Some trade-offs between more objects, more APIs, and less privacy • WebGL, baery status • Browser fingerprinng • AppCache • Web Storage

38 String Concatenaon Checklist

• Normalize the data • Character set conversions (e.g. ⇄ UTF-8, reject or replace bad sequences) • Character encoding conversion (e.g. %xx) • Idenfy the output context • DOM node, aribute name, aribute value, script, etc. • Apply controls at security boundaries • Time of Check, Time of Use -- Idenfy where data will be modified, stored, or rendered • Strip characters (carefully! prefer inclusion list to exclusion list) • Replace characters appropriate for context

39 Some Web Security Principles

• Always be suspicious of string concatenaon • Abstract development to a more strongly-typed language, compile to JavaScript • Protect Web Storage data • Don’t use it for security-sensive data, • Pay aenon to DOM context • HTML enty, percent encoding, String object, text node • Apply CORS and CSP headers to protect browsers from applicaon mistakes • And X-Frame-Opons

40 JavaScript

• Audit string concatenaon • Avoid inline event handlers • $(#id).bind(...) • $(#id).click(...) • $(#id).on(...) • Embrace "use strict"; • Encounter errors more quickly, more loudly • Avoid implicit global scope problems • Remember to apply to each “code unit”

41 Security Loop

• Encourage users to update browsers • Supporng old browsers is a pain anyway

• Adopt established JavaScript libraries rather than custom implementaons • Shi from pure development to patch management

• Adopt HTML5 security features • ...to protect users with HTML5-enabled browsers

42 QUALYS SECURITY CONFERENCE 2012

LAS VEGAS MUNICH LONDON PARIS OCT 25-26 NOV 06 NOV 08 NOV 13

Thank You!

43