When the CDN goes bananas
•
1 like•635 views
How to protect your website assets with Subresource Integrity The slides were first presented on the SecTalks Sydney Meetup: http://www.meetup.com/SecTalks/events/228854146/
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to When the CDN goes bananas
Similar to When the CDN goes bananas (20)
More from Gabor Szathmari
More from Gabor Szathmari (13)
Recently uploaded
Recently uploaded (20)
When the CDN goes bananas
- 1. WHEN THE CDN GOES BANANAS SUBRESOURCE INTEGRITY
- 2. WHEN THE CDN GOES BANANAS me_irl • Gabor Szathmari • Information Security Professional Hacker Freelancer • Privacy Advocate
- 3. WHEN THE CDN GOES BANANAS I WILL BE TALKING ABOUT • JavaScript hosted by third-parties • Some scary bits • The Solution: Subresource Integrity ‣ What it does ‣ Tooling
- 4. THIRD-PARTY CODE ON MODERN WEBSITES
- 5. ANALYTICS
- 6. A/B TESTING
- 7. HEATMAPS
- 8. TAG MANAGERS
- 9. PRIVATE CDN
- 10. PUBLIC CDN
- 12. WHEN THE CDN GOES BANANAS MODERN WEBSITES • Third-party JavaScript (heatmaps, user tracking, analytics …) • Public CDNs (jsDelivr, ajax.googleapis.com, ajax.aspnetcdn.com …) • Private CDNs (S3, Akamai, CloudFront, Fastly …)
- 13. “YOU KNOW WHAT THEY SAY: LOVE* IS BLIND”* <script src=“”>
- 16. WHAT CAN GO WRONG?
- 17. WHEN THE CDN GOES BANANAS MODERN WEBSITES • Third-party JavaScript (heatmaps, user tracking, analytics …) • Public CDNs (jsDelivr, ajax.googleapis.com, ajax.aspnetcdn.com …) • Private CDNs (S3, Akamai, CloudFront, Fastly …) HACKED
- 19. WHEN THE CDN GOES BANANAS 🙀 🙀 🙀 • https://www.maxcdn.com/blog/bootstrapcdn-security-post-mortem/ • https://blog.pagefair.com/2015/halloween-security-breach/ • https://citizenlab.org/2015/04/chinas-great-cannon/ • http://securityaffairs.co/wordpress/31480/cyber-crime/afghanistan- cdn-network-hacked.html • https://medium.com/@FredericJacobs/the-reuters-compromise-by- the-syrian-electronic-army-6bf570e1a85b
- 22. WHEN THE CDN GOES BANANAS WHAT IS THE DAMAGE? • Unwanted redirection • Website defacement • Click fraud • Exploit kits (ransomware) • Cookie stealing, session hijacking • Keylogging • UI redressing (password stealing, OTP stealing)
- 24. WHAT CAN WE DO?
- 32. WHEN THE CDN GOES BANANAS BROWSER SUPPORT
- 33. WHEN THE CDN GOES BANANAS
- 34. TOOLING
- 35. MANUAL HASHING
- 36. WHEN THE CDN GOES BANANAS OPENSSL • openssl dgst -sha256 -binary jquery.min.js | openssl base64 -A • openssl dgst -sha384 -binary jquery.min.js | openssl base64 -A • openssl dgst -sha512 -binary jquery.min.js | openssl base64 -A
- 37. WHEN THE CDN GOES BANANAS OPENSSL • $ curl -s https://code.jquery.com/jquery-2.2.3.min.js | openssl dgst -sha512 -binary | openssl base64 -A SFaNb3xC08k/Wf6CRM1J+O/vv4YWyrPBSdy0o+1nqKzf +uLrIBnaeo8aYoAAOd31nMNHwX8zwVwTMbbCJjA8Kg== • <script src=“https://code.jquery.com/jquery-2.2.3.min.js” integrity=“sha512-SFaNb3xC08k/Wf…” […]
- 38. HOSTED TOOLS
- 40. CMS
- 41. WHEN THE CDN GOES BANANAS PLUGINS • WordPress https://wordpress.org/plugins/wp-sri/ • Drupal https://www.drupal.org/project/advagg
- 43. WHEN THE CDN GOES BANANAS WORKFLOW INTEGRATION
- 44. WHEN THE CDN GOES BANANAS WORKFLOW INTEGRATION
- 45. SCAN YOUR WEBSITE FOR SRI USAGE
- 46. SRITEST.IO
- 47. SRITEST.IO
- 48. WHEN THE CDN GOES BANANAS TOOLING • Manual • Hosted • CMS Plugins • Workflow Integration • sritest.io
- 49. WHEN THE CDN GOES BANANAS SUMMARY • Modern websites rely on JS/CSS • Hosted on CDNs / at third-parties • SRI protects from unexpected JS/CSS changes • Tooling is available
- 50. WHEN THE CDN GOES BANANAS FURTHER READING • https://www.owasp.org/index.php/ 3rd_Party_Javascript_Management_Cheat_Sheet • http://j.mp/cdn-goes-bananas • http://j.mp/new-sri2-features ‣ Enforce SRI with CSP ‣ Violation Reporting
- 51. WHEN THE CDN GOES BANANAS THANK YOU• @gszathmari • PGP: keybase.io/gszathmari