6. Web Security

Typical applications include remote command-line login and remote command execution

Network Adapter

Session cookies could be revealed,

destroy your database

More reach

SSLv3 and TLS are almost the same

The primary purpose of ____ is to help with navigation

Security for IP datagrams

store information only as long as you're using the browser;

a malicious script is injected directly into a vulnerable web application.

PGP, Kerberos, SSH, etc.

code digitally signed

Two URLs are said to have the same origin if they share the same

placement of malicious code in SQL statements, inside the web page input fields.

Implemented in end-hosts

allowing HTML tags in comments section, bad HTML tag executes malicious script

Device Driver

Harder

basic security model enforced in the browser

When you browse the Internet, information about your computer may be collected and stored.

specific to each applications; implemented in single application

SoP can be bypassed in Cross-Site-Scripting attacks

scripts are often a way for attackers to download malicious code to a user's computer.

Java and ActiveX controls are actual programs that reside on your computer.

If an attacker gains access to your computer, they may be able to gather personal info.

which acces permited: http://www.example.com/account/

provide strong authentication for client/server applications by using secret-key cryptography.

Page content modified, misleading users into willingly surrendering their private data

which acces permited: http://websitex.com/example/example.html

any network service can be secured with SSH.

In HTTPS, the communication protocol is encrypted using

IP

Security for application messages;

Plug-ins / Extensions / Active Code:

User accounts may be compromised

Sandboxing, Isolation and

A small software module for customizing a web browser.

Java and ActiveX controls and JavaScript are the same.

the users of the web application are the ones at risk

Security for TCP segments;

Basic and Digest

Tools: (HTTPS, PGP, Kerberos, SSH, etc.)

Usually just source code

ActiveX

JavaScript

enables attackers to inject client-side scripts into web pages viewed by other users.

The script embedded into link, which sends request to website with vulnerability..

crypt network protocol for operating network services securely over an unsecured network.

whic acces permited: http://websitex.com/example/example.html

general solution for all Internet traffic; implemented in OS

Hardware encryption is inefficient

Trojan horse programs activated

Plug-ins are always executables

Web pages (HTML) can embed dynamic content (code or scripts) that can executed on the browser

vulnerability may be used by attackers to bypass access controls such as the same-origin policy

more damaging of the two

used for signing, encrypting, and decrypting texts, e- mails, files, directories.

A script from Page A can only access data from page B if they are of the same origin.

Uses public Key Infrastructure.

Technology proposal that enables users to opt out of tracking by websites they do not visit.

Many attacks today exploit browser vulnerabilities.

Only the site that stores some information in the browser may later read or modify that info

Provides encryption and authentication

once you close the browser, the information is erased

It use Nonce to prevent reply attack.

network authentication protocol.

Types of ___: user interface modifications, ad blocking, and cookie management

The script is only activated once that link is clicked on.

A hacker might get access to all db, by inserting 105 OR 1=1 into the input field.

Browsers are not complex

Code executed in browser has only restricted access to OS, network

additional layer to the TCP/IP stack that sits between the Application and Transport layers

Encryption program provides cryptographic privacy and authentication for data communication

Same-origin policy, allows script on one page to access properties of document from another

Less common

used for whole disk partitions and to increase the security of e-mail communications.

Adobe Acrobat, Flash, Apple QuickTime, etc.

Implemented in end-hosts

Communications can be altered, examined and exploited.

Advantage: Extend application without involving operating system.

All communications between your browser and the website are encrypted

general solution for all TCP-based applications; implemented in libraries/applications

Online business’s reputation/relationship with clients compromised

Browsers are subject to perimeter protection.

In most browsers, you can adjust the length of time that ___ are stored.

Hardware encryption

It is vulnerable to replay attacks

userid and password are sent base 64 encoded (might as well be plain text)

isolates the scripts and resources downloaded from different origins

Disadvantage: Security mechanisms have to be designed independently of each application.

May reveal private information (in forms, cookies)

reflecting of a malicious script off of a web application, onto a user’s browser

The Internet was not created with security in mind.

Internet is primarily comprised of : Public, Un-trusted and Unreliable IP networks