BlackHat USA 2010: Bursztein - Bad Memories

[Nytro]

BlackHat USA 2010: Bursztein - Bad Memories

1 Introduction

2 Breaking into a WPA network with a Webpage

2.1 Dealing with Browser Behavior

2.2 Finding the router

2.3 Fingerprinting the router

2.4 Login to the router

2.5 Stealing WIFI information

2.6 Geolocalization

3 Defeating HTTPS via cache injection

3.1 How cache injection works

3.2 Why cache injection are dangerous

3.3 Exploiting Browser UI Inconsistency

4 Attacking Facebook with Frame leak attack 18

5 Phone TapJacking 20

5.1 TapJacking Safari on Iphone

5.2 Other mobile browsers

6 Related Work

7 Conclusion

Bad memories summarize our latest research results on offensive web technologies. The Security

Lab is a part of the Computer Science Department at Stanford University. Research projects

in the group focus on various aspects of network and computer security.

While secure communication protocols have received a lot of attention and have been widely

deployed over the last few years, the way their sensitive data is stored remains a weak link in

practice. The purpose of this paper is to raise awareness of this fact and demonstrate that attackers

can make such secure communication protocols irrelevant by targeting the data storage mechanism.

In this paper, we demonstrate the weakness of current storage mechanisms by showing the following

attacks: first, we show how an attacker can remotely locate and break into a Wifi network

by crafting a malicious web page that targets its access point. Secondly, we demonstrate how an

attacker can inject a malicious library that is capable of compromising subsequent SSL sessions by

leveraging the fact that websites trust external javascript libraries, such as Google Analytics. We

then describe how to easily fool the user into accepting this malicious javascript library by exploiting

browser UI corner cases. Next, we introduce frame leak attacks that are capable of extracting

private information from the website (and not from the user) by leveraging the recent scrolling

technique of Stone. Our frame leak attacks defeat click-jacking defenses that have previously been

considered secure. In addition, we illustrate how a frame leak attack works by demonstrating how

to use it to extract Facebook profile information, bypassing Facebook’s framebusting defenses

in the process. Finally, we develop a new attack called tap-jacking that uses features of mobile

browsers to implement a strong clickjacking attack on phones. We show that tap-jacking on a

phone is more powerful than traditional clickjacking attacks on desktop browsers, and thus imply

smartphones should not be considered a secure form of data storage.

Download:

https://media.blackhat.com/bh-us-10/whitepapers/Bursztein_Gourdin_Rydstedt/BlackHat-USA-2010-Bursztein-Bad-Memories-wp.pdf

Edited November 27, 2011 by Nytro