1. Beware of Finer-Grained Origins
Collin Jackson
Adam Barth
Stanford University

2. Security Context Determined By URL
"Origin" =
Scheme
Host
(Port)

3. Sub-Origin Privileges
Contamination

4. Trust Specified By URL Import Export
<script src="prototype.js"></script>
<link rel="stylesheet" href="base.css">
Export
<form action="login.cgi">
var xhr = new XMLHttpRequest();
xhr.open("POST", "ajax.php");

5. Threat Models Web Attacker Upgrade: Network Attacker
Free user visit
Upgrade: Network Attacker
Eavesdrop
Corrupt network traffic
Upgrade: Cert-Mismatch Attacker
User clicks through certificate errors
Attacker still does not have trusted site’s certificate
Cross-Path Attacker
Same “origin” as good site, different path

6. Browser Features   Defenses Feature Sub-Origin Privilege Attacker
Origin Contamination
Library Import
Data Export
Cookie Paths
Read Cookie  
WSKE
Certificate Errors (IE7)
Show Lock EV
Show Organization
Locked Same-Origin Policy
Petname Toolbar
Show Petname
Passpet
Obtain Password
Mixed Content
N/A
enablePrivilege
Install Software
IP-based Origins
Network Requests

7. Mixed Content

8. WSKE Web Server Key-Enabled Cookies
“Secure” cookies only sent for same TLS key

9. Locked SOP Finer-grained origin (scheme, host, port, broken)
“Broken” HTTPS page can’t script valid HTTPS page
Banks often import libraries
<script src="
User clicks through cert error for paypalobjects.com
Real PayPal imports script from paypalobjects.com
Attacker runs script as “unbroken” PayPal
Sites cannot safely use <script src="…">, CSS, SWF, etc

10. More Anti-Phishing using Certificates
Ignore the address bar, use cert instead
Extended Validation
Passpet
Petname
What about ?

11. TLS Forwarding Certificate belongs to bank
Domain name belongs to attacker
Attacker can hijack session at any time
Certificate UI is confused

12. TLS Forwarding Example

13. TLS Forwarding - Consequences
Might not be PayPal
This is really PayPal, right?

14. TLS Forwarding Network Attack
Origin contamination
Polluted cache

15. Firefox enablePrivilege API

16. Abusing enablePrivilege
Relies on certificate, ignores host name
Signed HTML can import libraries and be scripted by its origin
Is this code really from Yahoo!?

17. Cookie Paths http://www.stanford.edu/~alice
Set-Cookie: skrt=04f4; path=/~alice
Set-Cookie: skrt=52f9; path=/~eve
<iframe src="/~alice"></iframe>
alert(frames[0].document.cookie);

18. DNS Rebinding Attack <iframe src="http://www.evil.com"> Firewall
[DWF’96, R’01]
DNS Rebinding Attack
<iframe src="
DNS-SEC cannot
stop this attack
Firewall
ns.evil.com
DNS server
TTL = 0
web server
corporate
web server
Read permitted: it’s the “same origin”

19. <script src="prototype.js"></script>
IP-based Origins
Finer-grained origin (scheme, host, port, IP)
imports
<script src="prototype.js"></script>
serves evil script
Read contents of document
POST it back to

20. SOLUTIONS

21. Embrace Grant privileges to origins Cross-site XHR XDomainRequest
Frame Navigation
Local Storage
postMessage
Phishing Filter
Password Database

22. https://y-cl7h3f7jwyj3fvmw7jpnjfvf2xlcmayi.yurl.net/
Extend
Include fine-grained origin in URL
YURL:
HTTPEV:
httpev://

23. Destroy Problem: documents that lack the sub-origin privilege
Eliminate privilege
SafeLock
Eliminate document
ForceHTTPS
ForceCertificate
Strict Petname

24. Solutions   Defenses Feature Sub-Origin Privilege Attacker
Origin Contamination
Library Import
Data Export
Cookie Paths
Read Cookie  
WSKE
Certificate Errors (IE7)
Show Lock EV
Show Organization
Locked Same-Origin Policy
Petname Toolbar
Show Petname
Passpet
Obtain Password
Mixed Content
N/A
enablePrivilege
Install Software
IP-based Origins
Network Requests

25. Solutions  Extend Destroy  Defenses Feature Sub-Origin Privilege
Attacker
Origin Contamination
Library Import
Data Export
Cookie Paths
Read Cookie 
Extend
WSKE
Certificate Errors (IE7)
Show Lock
Destroy EV
Show Organization
Locked Same-Origin Policy
Petname Toolbar
Show Petname
Passpet
Obtain Password
Mixed Content
N/A
enablePrivilege
Install Software
IP-based Origins
Network Requests 

26. Summary Sub-origin privileges don’t work
Origin contamination
Privilege escalation via script injection
Beware of finer-grained origins
Trust specified by URL
Import/Export
Three approaches for new features
Embrace, extend, destroy