The Experts below are selected from a list of 582 Experts worldwide ranked by ideXlab platform

Mohammad Zulkernine - One of the best experts on this subject based on the ideXlab platform.

  • client side detection of cross site Request Forgery attacks
    International Symposium on Software Reliability Engineering, 2010
    Co-Authors: Hossain Shahriar, Mohammad Zulkernine
    Abstract:

    Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack Request takes advantage of the fact that a browser appends valid session information for each Request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform Requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected Request with a form’s input fields and values that are being displayed on a webpage (visibility). To overcome an attacker’s attempt to circumvent form visibility checking, we compare the response content type of a suspected Request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack Requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack Requests that include subsets of visible form fields and values.

  • ISSRE - Client-Side Detection of Cross-Site Request Forgery Attacks
    2010 IEEE 21st International Symposium on Software Reliability Engineering, 2010
    Co-Authors: Hossain Shahriar, Mohammad Zulkernine
    Abstract:

    Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack Request takes advantage of the fact that a browser appends valid session information for each Request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform Requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected Request with a form’s input fields and values that are being displayed on a webpage (visibility). To overcome an attacker’s attempt to circumvent form visibility checking, we compare the response content type of a suspected Request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack Requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack Requests that include subsets of visible form fields and values.

Hossain Shahriar - One of the best experts on this subject based on the ideXlab platform.

  • SIN - Security vulnerabilities and mitigation techniques of web applications
    Proceedings of the 6th International Conference on Security of Information and Networks - SIN '13, 2013
    Co-Authors: Hossain Shahriar
    Abstract:

    Web applications contain vulnerabilities, which may lead to serious security breaches such as stealing of confidential information. To protect against security breaches, it is necessary to understand the detailed steps of attacks and the pros and cons of existing defense mechanisms. This tutorial provides an overview of four web application security vulnerabilities: SQL injection, Cross-Site Scripting, Cross-Site Request Forgery, and clickjacking. Then it discusses two popular mitigation approaches: security testing and monitoring. The tutorial is intended to enable practitioners for choosing the right technique to defend against web application security vulnerabilities.

  • client side detection of cross site Request Forgery attacks
    International Symposium on Software Reliability Engineering, 2010
    Co-Authors: Hossain Shahriar, Mohammad Zulkernine
    Abstract:

    Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack Request takes advantage of the fact that a browser appends valid session information for each Request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform Requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected Request with a form’s input fields and values that are being displayed on a webpage (visibility). To overcome an attacker’s attempt to circumvent form visibility checking, we compare the response content type of a suspected Request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack Requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack Requests that include subsets of visible form fields and values.

  • ISSRE - Client-Side Detection of Cross-Site Request Forgery Attacks
    2010 IEEE 21st International Symposium on Software Reliability Engineering, 2010
    Co-Authors: Hossain Shahriar, Mohammad Zulkernine
    Abstract:

    Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack Request takes advantage of the fact that a browser appends valid session information for each Request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform Requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected Request with a form’s input fields and values that are being displayed on a webpage (visibility). To overcome an attacker’s attempt to circumvent form visibility checking, we compare the response content type of a suspected Request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack Requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack Requests that include subsets of visible form fields and values.

Stefano Calzavara - One of the best experts on this subject based on the ideXlab platform.

  • Machine Learning for Web Vulnerability Detection: The Case of Cross-Site Request Forgery
    IEEE Security & Privacy, 2020
    Co-Authors: Stefano Calzavara, Mauro Conti, Riccardo Focardi, Alvise Rabitti, Gabriele Tolomei
    Abstract:

    We propose a methodology to leverage machine learning (ML) for the detection of web application vulnerabilities. We use it in the design of Mitch, the first ML solution for the black-box detection of Cross-Site Request Forgery vulnerabilities. Finally, we show the effectiveness of Mitch on real software.

  • ESORICS (2) - Testing for Integrity Flaws in Web Sessions
    Lecture Notes in Computer Science, 2019
    Co-Authors: Stefano Calzavara, Alvise Rabitti, Alessio Ragazzo, Michele Bugliesi
    Abstract:

    Web sessions are fragile and can be attacked at many different levels. Classic attacks like session hijacking, session fixation and Cross-Site Request Forgery are particularly dangerous for web session security, because they allow the attacker to breach the integrity of honest users’ sessions by forging Requests which get authenticated on the victim’s behalf. In this paper, we systematize current countermeasures against these attacks and the shortcomings thereof, which may completely void protection under specific assumptions on the attacker’s capabilities. We then build on our security analysis to introduce black-box testing strategies to discover insecure session implementation practices on existing websites, which we implement in a browser extension called Dredd. Finally, we use Dredd to assess the security of 20 popular websites from Alexa, exposing a number of session integrity flaws.

  • Client side web session integrity as a non-interference property: Extended version with proofs
    2014
    Co-Authors: Wilayat Khan, Stefano Calzavara, Michele Bugliesi, Willem De Groef, Frank Piessens
    Abstract:

    Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of Cross-Site Request Forgery or malicious script inclusion. This paper defines a variant of non-interference – the classical security notion from information flow security – that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions. Client Side Web Session Integrity as a Non-Interference Property: Extended Version

  • ICISS - Client Side Web Session Integrity as a Non-interference Property
    Information Systems Security, 2014
    Co-Authors: Wilayat Khan, Stefano Calzavara, Michele Bugliesi, Willem De Groef, Frank Piessens
    Abstract:

    Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of Cross-Site Request Forgery or malicious script inclusion. This paper defines a variant of non-interference – the classical security notion from information flow security – that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions.

Michele Bugliesi - One of the best experts on this subject based on the ideXlab platform.

  • ESORICS (2) - Testing for Integrity Flaws in Web Sessions
    Lecture Notes in Computer Science, 2019
    Co-Authors: Stefano Calzavara, Alvise Rabitti, Alessio Ragazzo, Michele Bugliesi
    Abstract:

    Web sessions are fragile and can be attacked at many different levels. Classic attacks like session hijacking, session fixation and Cross-Site Request Forgery are particularly dangerous for web session security, because they allow the attacker to breach the integrity of honest users’ sessions by forging Requests which get authenticated on the victim’s behalf. In this paper, we systematize current countermeasures against these attacks and the shortcomings thereof, which may completely void protection under specific assumptions on the attacker’s capabilities. We then build on our security analysis to introduce black-box testing strategies to discover insecure session implementation practices on existing websites, which we implement in a browser extension called Dredd. Finally, we use Dredd to assess the security of 20 popular websites from Alexa, exposing a number of session integrity flaws.

  • Client side web session integrity as a non-interference property: Extended version with proofs
    2014
    Co-Authors: Wilayat Khan, Stefano Calzavara, Michele Bugliesi, Willem De Groef, Frank Piessens
    Abstract:

    Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of Cross-Site Request Forgery or malicious script inclusion. This paper defines a variant of non-interference – the classical security notion from information flow security – that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions. Client Side Web Session Integrity as a Non-Interference Property: Extended Version

  • ICISS - Client Side Web Session Integrity as a Non-interference Property
    Information Systems Security, 2014
    Co-Authors: Wilayat Khan, Stefano Calzavara, Michele Bugliesi, Willem De Groef, Frank Piessens
    Abstract:

    Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of Cross-Site Request Forgery or malicious script inclusion. This paper defines a variant of non-interference – the classical security notion from information flow security – that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions.

Ian Molloy - One of the best experts on this subject based on the ideXlab platform.

  • Defeating Cross-Site Request Forgery attacks with browser-enforced authenticity protection
    2014
    Co-Authors: Ziqing Mao, Ian Molloy
    Abstract:

    Abstract. A cross site Request Forgery (CSRF) attack occurs when a user’s web browser is instructed by a malicious webpage to send a Request to a vulnerable web site, resulting in the vulnerable web site performing actions not intended by the user. CSRF vulnerabilities are very common, and consequences of such attacks are most serious with financial web-sites. We recognize that CSRF attacks are an example of the confused deputy problem, in which the browser is viewed by websites as the deputy of the user, but may be tricked into sending Requests that violate the user’s intention. We propose Browser-Enforced Authenticity Protection (BEAP), a browser-based mechanism to defend against CSRF attacks. BEAP infers whether a Request reflects the user’s intention and whether an authentication token is sensitive, and stripes sensitive authentication tokens from any Request that may not reflect the user’s intention. The inference is based on the information about the Request (e.g., how the Request is triggered and crafted) and heuristics derived from analyzing real-world web applications. We have implemented BEAP as a Firefox browser extension, and show that BEAP can effectively defend against the CSRF attacks and does not break the existing web applications

  • defeating cross site Request Forgery attacks with browser enforced authenticity protection
    Financial Cryptography, 2009
    Co-Authors: Ninghui Li, Ian Molloy
    Abstract:

    A cross site Request Forgery (CSRF) attack occurs when a user's web browser is instructed by a malicious webpage to send a Request to a vulnerable web site, resulting in the vulnerable web site performing actions not intended by the user. CSRF vulnerabilities are very common, and consequences of such attacks are most serious with financial websites. We recognize that CSRF attacks are an example of the confused deputy problem, in which the browser is viewed by websites as the deputy of the user, but may be tricked into sending Requests that violate the user's intention. We propose Browser-Enforced Authenticity Protection (BEAP), a browser-based mechanism to defend against CSRF attacks. BEAP infers whether a Request reflects the user's intention and whether an authentication token is sensitive, and strips sensitive authentication tokens from any Request that may not reflect the user's intention. The inference is based on the information about the Request (e.g., how the Request is triggered and crafted) and heuristics derived from analyzing real-world web applications. We have implemented BEAP as a Firefox browser extension, and show that BEAP can effectively defend against the CSRF attacks and does not break the existing web applications.

  • defeating cross site Request Forgery attacks with browser enforced authenticity protection
    Annual Information Security Symposium, 2009
    Co-Authors: Ninghui Li, Ian Molloy
    Abstract:

    A cross site Request Forgery (CSRF) attack occurs when a user's web browser is instructed by a malicious webpage to send a Request to a vulnerable web site, resulting in the vulnerable web site performing actions not intended by the user. CSRF vulnerabilities are very common, and consequences of such attacks are serious. We recognize that CSRF attacks are an example of the confused deputy problem, in which the browser is viewed by websites as the deputy of the user, but may be tricked into sending Requests that violate the user's intention. We propose Browser-Enforced Authenticity Protection (BEAP), a browser-based mechanism to defend against CSRF attacks. BEAP infers whether a Request reflects the user's intention and whether an authentication token is sensitive, and stripes sensitive authentication tokens from any Request that may not reflect the user's intention. The inference is based on the information about the Request (e.g., how the Request is triggered and crafted) and heuristics derived from analyzing real-world web applications. We have implemented BEAP as a Firefox browser extension, and show that BEAP can effectively defend against the CSRF attacks and does not break the existing web applications.

  • Financial Cryptography - Defeating Cross-Site Request Forgery Attacks with Browser-Enforced Authenticity Protection
    Financial Cryptography and Data Security, 2009
    Co-Authors: Ziqing Mao, Ian Molloy
    Abstract:

    A cross site Request Forgery (CSRF) attack occurs when a user's web browser is instructed by a malicious webpage to send a Request to a vulnerable web site, resulting in the vulnerable web site performing actions not intended by the user. CSRF vulnerabilities are very common, and consequences of such attacks are most serious with financial websites. We recognize that CSRF attacks are an example of the confused deputy problem, in which the browser is viewed by websites as the deputy of the user, but may be tricked into sending Requests that violate the user's intention. We propose Browser-Enforced Authenticity Protection (BEAP), a browser-based mechanism to defend against CSRF attacks. BEAP infers whether a Request reflects the user's intention and whether an authentication token is sensitive, and strips sensitive authentication tokens from any Request that may not reflect the user's intention. The inference is based on the information about the Request (e.g., how the Request is triggered and crafted) and heuristics derived from analyzing real-world web applications. We have implemented BEAP as a Firefox browser extension, and show that BEAP can effectively defend against the CSRF attacks and does not break the existing web applications.