You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
833 lines
29 KiB
833 lines
29 KiB
<?xml version="1.0" encoding="utf-8"?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
|
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta name="generator" content=
|
|
"HTML Tidy for Linux/x86 (vers 11 February 2007), see www.w3.org" />
|
|
<meta http-equiv="Content-Type" content=
|
|
"text/html; charset=utf-8" />
|
|
|
|
<title>Web User Interaction: Threat Trees</title>
|
|
<link rel="home" title="Top" href="#title" />
|
|
<link rel="chapter" title="Abstract" href="#abstract" />
|
|
<link rel="chapter" title="Status of this Document" href=
|
|
"#status" />
|
|
<link rel="contents" title="Table of Contents" href=
|
|
"#contents" />
|
|
<link rel="chapter" title="1 Overview " href="#Overview" />
|
|
<link rel="chapter" title="2 Threat Trees" href=
|
|
"#Threat_Trees" />
|
|
<link rel="section" title="2.1 Main Tree" href="#Main_Tree" />
|
|
<link rel="section" title="2.2 Branches that may be out of scope"
|
|
href="#Branches_that_may_be_out_of_scope" />
|
|
<link rel="section" title="2.3 Uncategorized attacks" href=
|
|
"#Uncategorized_attacks" />
|
|
<link rel="section" title="2.4 HTTPS Branch of threat tree" href=
|
|
"#HTTPS_Branch_of_threat_tree" />
|
|
<link rel="chapter" title="3 Acknowledgements" href=
|
|
"#Acknowledgements" />
|
|
<link rel="chapter" title="4 References" href="#References" />
|
|
<style type="text/css">
|
|
/*<![CDATA[*/
|
|
code { font-family: monospace; }
|
|
|
|
div.constraint,
|
|
div.issue,
|
|
div.note,
|
|
div.notice { margin-left: 2em; }
|
|
|
|
ol.enumar { list-style-type: decimal; }
|
|
ol.enumla { list-style-type: lower-alpha; }
|
|
ol.enumlr { list-style-type: lower-roman; }
|
|
ol.enumua { list-style-type: upper-alpha; }
|
|
ol.enumur { list-style-type: upper-roman; }
|
|
|
|
|
|
div.exampleInner pre { margin-left: 1em;
|
|
margin-top: 0em; margin-bottom: 0em}
|
|
div.exampleOuter {border: 4px double gray;
|
|
margin: 0em; padding: 0em}
|
|
div.exampleInner { background-color: #d5dee3;
|
|
border-top-width: 4px;
|
|
border-top-style: double;
|
|
border-top-color: #d3d3d3;
|
|
border-bottom-width: 4px;
|
|
border-bottom-style: double;
|
|
border-bottom-color: #d3d3d3;
|
|
padding: 4px; margin: 0em }
|
|
div.exampleWrapper { margin: 4px }
|
|
div.exampleHeader { font-weight: bold;
|
|
margin: 4px}
|
|
|
|
|
|
[id]:hover:after {
|
|
content: " #" attr(id) " ";
|
|
font-size: 80%;
|
|
color: #ccc;
|
|
text-decoration: none;
|
|
}
|
|
|
|
a.borken {
|
|
background: #f99;
|
|
color: #000;
|
|
font-weight: bold;
|
|
}
|
|
|
|
p[id]:hover:after {
|
|
content: "";
|
|
}
|
|
|
|
a.anchor {
|
|
color: inherit;
|
|
font-weight: inherit;
|
|
text-decoration: none;
|
|
font-style: inherit;
|
|
}
|
|
|
|
p[id]:hover:before {
|
|
content: " #" attr(id) " ¶ ";
|
|
font-size: 80%;
|
|
color: #ccc;
|
|
text-decoration: none;
|
|
}
|
|
|
|
div.note {
|
|
font-weight: bold;
|
|
font-style: italic;
|
|
color: #008000;
|
|
border-left: 2px solid #008000;
|
|
margin-left: 0;
|
|
padding-left: 2em;
|
|
}
|
|
|
|
span.sqbrackets {
|
|
font-style: italic;
|
|
color: #005000;
|
|
}
|
|
|
|
div.exampleOuter {
|
|
padding-left: 2em;
|
|
padding-right: 2em;
|
|
border: 1px solid black;
|
|
background: #ffa;
|
|
}
|
|
|
|
/*]]>*/
|
|
</style>
|
|
<link rel="stylesheet" type="text/css" href=
|
|
"http://www.w3.org/StyleSheets/TR/W3C-WG-NOTE.css" />
|
|
</head>
|
|
|
|
<body>
|
|
<div class="head">
|
|
<p><a href="http://www.w3.org/"><img src=
|
|
"http://www.w3.org/Icons/w3c_home" alt="W3C" height="48" width=
|
|
"72" /></a></p>
|
|
|
|
<h1><a href="#title" id="title" name="title" class="anchor">Web
|
|
User Interaction: Threat Trees</a></h1>
|
|
|
|
<h2><a href="#w3c-doctype" id="w3c-doctype" name="w3c-doctype"
|
|
class="anchor">W3C Working Group Note 1 November 2007</a></h2>
|
|
|
|
<dl>
|
|
<dt>This version:</dt>
|
|
|
|
<dd><a href=
|
|
"http://www.w3.org/TR/2007/NOTE-wsc-threats-20071101/">http://www.w3.org/TR/2007/NOTE-wsc-threats-20071101/</a></dd>
|
|
|
|
<dt>Latest version:</dt>
|
|
|
|
<dd><a href=
|
|
"http://www.w3.org/TR/wsc-threats/">http://www.w3.org/TR/wsc-threats/</a></dd>
|
|
|
|
<dt>Editor:</dt>
|
|
|
|
<dd>Thomas Roessler, <a href=
|
|
"http://www.w3.org/">W3C</a></dd>
|
|
</dl>
|
|
|
|
<p class="copyright"><a href=
|
|
"http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> © 2007 <a href="http://www.w3.org/"><acronym title="World Wide Web Consortium">W3C</acronym></a><sup>®</sup>
|
|
(<a href="http://www.csail.mit.edu/"><acronym title=
|
|
"Massachusetts Institute of Technology">MIT</acronym></a>,
|
|
<a href="http://www.ercim.org/"><acronym title=
|
|
"European Research Consortium for Informatics and Mathematics">ERCIM</acronym></a>,
|
|
<a href="http://www.keio.ac.jp/">Keio</a>), All Rights
|
|
Reserved. W3C <a href=
|
|
"http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">
|
|
liability</a>, <a href=
|
|
"http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a>
|
|
and <a href=
|
|
"http://www.w3.org/Consortium/Legal/copyright-documents">document
|
|
use</a> rules apply.</p>
|
|
</div>
|
|
<hr />
|
|
|
|
<div>
|
|
<h2><a href="#abstract" id="abstract" name="abstract" class=
|
|
"anchor">Abstract</a></h2>This Note includes threat trees used
|
|
to analyze the threats that the <a href=
|
|
"#ref-wsc-xit">[WSC-XIT]</a> responds to. It is a companion
|
|
document to <a href="#ref-wsc-usecases">[WSC-USECASES]</a>.
|
|
</div>
|
|
|
|
<div>
|
|
<h2><a href="#status" id="status" name="status" class=
|
|
"anchor">Status of this Document</a></h2>
|
|
|
|
<p>This section describes the status of this document at the
|
|
time of its publication. Other documents may supersede this
|
|
document. A list of current W3C publications and the latest
|
|
revision of this technical report can be found in the <a href=
|
|
"http://www.w3.org/TR/">W3C technical reports index</a> at
|
|
http://www.w3.org/TR/.</p>
|
|
|
|
<p>This document is published as a companion document to
|
|
<a href="#ref-wsc-usecases">[WSC-USECASES]</a>, to make some of
|
|
the group's analysis available to a larger public.</p>
|
|
|
|
<p>This document was developed by the <a href=
|
|
"http://www.w3.org/2006/WSC/">Web Security Context Working
|
|
Group</a>.</p>
|
|
|
|
<p>The content of this document is mostly analytic. This
|
|
document is published as a snapshot, and may be updated and
|
|
changed as needed when the Working Group's analysis develops
|
|
further.</p>
|
|
|
|
<p>Please send comments about this document to
|
|
public-usable-authentication@w3.org (with <a href=
|
|
"http://lists.w3.org/Archives/Public/public-usable-authentication/">
|
|
public archive</a>).</p>
|
|
|
|
<p>Publication as a Working Group Note does not imply
|
|
endorsement by the W3C Membership. This is a draft document and
|
|
may be updated, replaced or obsoleted by other documents at any
|
|
time. It is inappropriate to cite this document as other than
|
|
work in progress.</p>
|
|
|
|
<p>This document was produced by a group operating under the
|
|
<a href=
|
|
"http://www.w3.org/Consortium/Patent-Policy-20040205/">5
|
|
February 2004 W3C Patent Policy</a>. W3C maintains a <a href=
|
|
"http://www.w3.org/2004/01/pp-impl/39814/status">public list of
|
|
any patent disclosures</a> made in connection with the
|
|
deliverables of the group; that page also includes instructions
|
|
for disclosing a patent. An individual who has actual knowledge
|
|
of a patent which the individual believes contains <a href=
|
|
"http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential">
|
|
Essential Claim(s)</a> must disclose the information in
|
|
accordance with <a href=
|
|
"http://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Disclosure">
|
|
section 6 of the W3C Patent Policy</a>.</p>
|
|
</div>
|
|
|
|
<div class="toc">
|
|
<h2><a href="#contents" id="contents" name="contents" class=
|
|
"anchor">Table of Contents</a></h2>
|
|
|
|
<p class="toc">1 <a href="#Overview">Overview</a><br />
|
|
2 <a href="#Threat_Trees">Threat Trees</a><br />
|
|
2.1 <a href="#Main_Tree">Main
|
|
Tree</a><br />
|
|
2.2 <a href=
|
|
"#Branches_that_may_be_out_of_scope">Branches that may be out
|
|
of scope</a><br />
|
|
2.3 <a href=
|
|
"#Uncategorized_attacks">Uncategorized attacks</a><br />
|
|
2.4 <a href=
|
|
"#HTTPS_Branch_of_threat_tree">HTTPS Branch of threat
|
|
tree</a><br />
|
|
3 <a href="#Acknowledgements">Acknowledgements</a><br />
|
|
4 <a href="#References">References</a><br /></p>
|
|
</div>
|
|
<hr />
|
|
|
|
<div class="body">
|
|
<div class="div1">
|
|
<h2><a href="#Overview" id="Overview" name="Overview" class=
|
|
"anchor">1 Overview</a></h2>
|
|
|
|
<p>This document includes a high-level analysis of threats
|
|
faced in common Web usage scenarios.</p>
|
|
|
|
<p>In the analysis, high-level threats are decomposed into
|
|
the vulnerabilities that can be used by an attacker to
|
|
realize that threat. These vulnerabilities can be met by
|
|
countermeasures, which can in turn have vulnerabilities of
|
|
their own, and so on.</p>
|
|
|
|
<p>For example, to lure a user to a site that is controlled
|
|
by an attacker, the attacker might use DNS spoofing (or
|
|
similar techniques) to divert the user to a site of the
|
|
attacker's choice. As a countermeasure, TLS could be
|
|
deployed. If that countermeasure is in place, an attacker can
|
|
try to obtain a certification authority to issue a
|
|
certificate that can be used as part of an attack.</p>
|
|
|
|
<p>For a more extensive introduction of the process, see
|
|
chapter 4, Threat Modeling, of <a href=
|
|
"#ref-securecode">[SECURECODE]</a>.</p>
|
|
</div>
|
|
|
|
<div class="div1">
|
|
<h2><a href="#Threat_Trees" id="Threat_Trees" name=
|
|
"Threat_Trees" class="anchor">2 Threat Trees</a></h2>
|
|
|
|
<div class="div2">
|
|
<h3><a href="#Main_Tree" id="Main_Tree" name="Main_Tree"
|
|
class="anchor">2.1 Main Tree</a></h3>
|
|
|
|
<ol class="enumar">
|
|
<li>
|
|
<p><em>Luring Attacks</em> - luring a user to the wrong
|
|
site so that he connects to address not owned by party
|
|
he believes it to be owned by</p>
|
|
|
|
<ol class="enumla">
|
|
<li>Attacker registers domain names similar to that
|
|
of the legitimate domain and waits for users to
|
|
mistype or mis-remember a URL.</li>
|
|
|
|
<li>Attacker convinces user to bookmark the
|
|
impersonated site's address with misleading
|
|
information
|
|
|
|
<ol class="enumlr">
|
|
<li>Attacker constructs misleading page title
|
|
which the browser will automatically copy into
|
|
the default bookmark name.</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Attacker lures victim using a link in another
|
|
application
|
|
|
|
<ol class="enumlr">
|
|
<li>Email</li>
|
|
|
|
<li>IM</li>
|
|
|
|
<li>VOIP</li>
|
|
|
|
<li>Voice (e.g. calls purporting to be from
|
|
site's security department)</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Attacker inserts or replaces links provided by
|
|
other sites users trust (e.g. search engines)</li>
|
|
|
|
<li>After user initiates a connection to the correct
|
|
address, the attacker attacker intercepts
|
|
communications to that address and forges responses
|
|
from that address
|
|
|
|
<ol class="enumlr">
|
|
<li>Compromise a DNS server on route from root to
|
|
requested domain</li>
|
|
|
|
<li>Intercept DNS request and replace query
|
|
response with forged response</li>
|
|
|
|
<li>Insert data into user's hosts file so that
|
|
DNS query is not required (out of
|
|
scope---attacker this powerful easily insert
|
|
spyware)</li>
|
|
|
|
<li>
|
|
<p>Countermeasure: HTTPS - See <a href=
|
|
"#HTTPS_Branch_of_threat_tree"><b>2.4 HTTPS
|
|
Branch of threat tree</b></a></p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Intercept and replace communications between
|
|
client and the address of the legitimate site
|
|
|
|
<ol class="enumlr">
|
|
<li>Take control of a system through which
|
|
communications is routed</li>
|
|
|
|
<li>Create a wifi access point and lure users to
|
|
it</li>
|
|
|
|
<li>Attack the infrastructure through which
|
|
routes are established (BGP-based attacks)</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>
|
|
<p><em>Site Impersonation Attacks</em> - an attack in
|
|
which the attacker attempts to mimic someone else's
|
|
website. Potential goals include credential theft (e.g.
|
|
password theft), theft of other private information
|
|
from user (bank account and routing numbers), or
|
|
forging information sent to user (e.g. fake news story
|
|
that will cause user to buy or sell stock).</p>
|
|
|
|
<ol class="enumla">
|
|
<li>Address spoofing
|
|
|
|
<ol class="enumlr">
|
|
<li>Attacker registers confusing domain name
|
|
|
|
<ol class="enumua">
|
|
<li>semantic attacks
|
|
(e.g.,"ebay-security.com")</li>
|
|
|
|
<li>syntax attacks (e.g., "paypai.com", use
|
|
of non-ASCII characters)</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Attacker takes advantage of browser
|
|
vulnerabilities</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Page Spoofing
|
|
|
|
<ol class="enumlr">
|
|
<li>attacker copies content and indicators from
|
|
legitimate website content into the content of an
|
|
attack page (may add, remove or replace security
|
|
indicators)</li>
|
|
|
|
<li>attacker uses pop-up windows that mimic
|
|
legitimate site</li>
|
|
|
|
<li>attacker presents warning or error messages
|
|
(e.g., to confuse user, to justify why security
|
|
indicators/information is missing)</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Chrome Spoofing
|
|
|
|
<ol class="enumlr">
|
|
<li>attacker copies chrome elements (e.g., green
|
|
EV address bar), entire chrome window or dialog
|
|
boxes into the content of a website (also known
|
|
as Picture in Picture Attacks)</li>
|
|
|
|
<li>attacker mimics customized chrome content
|
|
(when customization is used as an anti-spoofing
|
|
technique, the attacker may use an educated guess
|
|
to replicate customization</li>
|
|
|
|
<li>attacker exploits flaws in GUI logic to
|
|
control what is displayed in chrome elements
|
|
(e.g. in the title bar, status bar or address
|
|
bar)</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>
|
|
<p><em>Cross-site request forgery</em> - (see <a href=
|
|
"#ref-csrf">[CSRF]</a>)- causing a user to unwittingly
|
|
send, to a legitimate site, a request containing data
|
|
that he/she would not otherwise intend to send (e.g. to
|
|
perform an action that he/she did not intend to
|
|
take).</p>
|
|
|
|
<ol class="enumla">
|
|
<li>Attacker may first convince user to login to the
|
|
target legitimate website (possibly in a separate
|
|
window or tab).
|
|
|
|
<ol class="enumlr">
|
|
<li>[Sequential first step] Attacker constructs a
|
|
link or form with field values that replicate
|
|
those that would be sent if user legitimately
|
|
wanted to perform this action.</li>
|
|
|
|
<li>[Sequential second step] Attacker causes the
|
|
browser to send this link to the legitimate
|
|
website.</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Induce user to submit form data
|
|
|
|
<ol class="enumlr">
|
|
<li>Lure user to click on link to cause GET
|
|
request with attacker-specified parameters</li>
|
|
|
|
<li>Lure user to click on form that will send
|
|
HTTP POST request with attacker-specified
|
|
parameters</li>
|
|
|
|
<li>Uses javascript to automatically send the
|
|
form (form.submit())</li>
|
|
|
|
<li>If user is not already logged in, attacker
|
|
may rely on the user login when reaching the
|
|
site. Many sites will then process the form data
|
|
from the initial request.</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>
|
|
<p><em>Cross-site scripting</em>- the injection of code
|
|
into vulnerable web applications, which copy this code
|
|
into web content in a form that would allow it to be
|
|
executed when read by another user. An exploited
|
|
cross-site scripting vulnerability can be used by
|
|
attackers to bypass access controls such as the same
|
|
origin policy. (This definition borrows heavily from
|
|
that of <a href="#ref-xss">[XSS]</a>.) Potential goals
|
|
include session hijacking (e.g. stealing a session
|
|
cookie), credential theft (e.g. password theft), theft
|
|
of other private information from user (bank account
|
|
and routing numbers), or forging information sent to
|
|
user (e.g. fake news story that will cause user to buy
|
|
or sell stock).</p>
|
|
|
|
<ul>
|
|
<li>[First sequential step] Construct content to
|
|
appear on legitimate site
|
|
|
|
<ol class="enumla">
|
|
<li>Create an attack script to execute in other
|
|
users' browsers
|
|
|
|
<ol class="enumlr">
|
|
<li>Use the script to instruct other user's
|
|
browsers to send script-accessible
|
|
credentials (e.g. cookies) or other data to
|
|
the attacker</li>
|
|
|
|
<li>
|
|
<p>Use the script, which will execute in
|
|
other user's browsers within the site's
|
|
domain context, in order to execute actions
|
|
as that user or to gather additional data.
|
|
(For example, adding the attacker as a
|
|
trusted user/friend/administrator as was
|
|
the case with the <a href=
|
|
"#ref-mspworm">[MSPWORM]</a>.)</p>
|
|
</li>
|
|
|
|
<li>Use the content or script to exploit a
|
|
vulnerability in the browser</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Create content intended to appear to the user
|
|
as if is content generated entirely by the
|
|
legitimate site (and not a rendering of other
|
|
user's input).
|
|
|
|
<ol class="enumlr">
|
|
<li>Create HTML for a fake login form or
|
|
information request form which, when
|
|
submitted, directs data to attacker.</li>
|
|
|
|
<li>Create HTML content with other misleading
|
|
information that might affect user behavior
|
|
(e.g. a fake news story that could cause a
|
|
stock's price to rise or fall).</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>[Second sequential step] Inject content into
|
|
pages served by legitimate site
|
|
|
|
<ol class="enumla">
|
|
<li>Use a cross-site request forgery attack (see
|
|
above)
|
|
|
|
<ul>
|
|
<li>Cross-site scripting attacks that use
|
|
this approach are known as type 1
|
|
attacks.</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>Insert the script yourself into content that
|
|
the site will serve to other users (e.g. a
|
|
discussion group posting).
|
|
|
|
<ul>
|
|
<li>Cross-site scripting attacks that use
|
|
this approach are known as type 2
|
|
attacks</li>
|
|
</ul>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>
|
|
<p><em>Network-based eavesdropping-</em> a passive
|
|
attack in which the attacker collects network traffic
|
|
and reads the data sent between the client and the
|
|
website. Potential goals include session hijacking
|
|
(e.g. stealing a session cookie), credential theft
|
|
(e.g. password theft), theft of other private
|
|
information from user (bank account and routing
|
|
numbers)</p>
|
|
|
|
<ol class="enumla">
|
|
<li>Attacker gains physical access to network and
|
|
installs monitoring hardware/software</li>
|
|
|
|
<li>
|
|
<p>Attacker establishes rogue network (e.g. public
|
|
WiFi access point) and waits for victims to join
|
|
it</p>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</div>
|
|
|
|
<div class="div2">
|
|
<h3><a href="#Branches_that_may_be_out_of_scope" id=
|
|
"Branches_that_may_be_out_of_scope" name=
|
|
"Branches_that_may_be_out_of_scope" class="anchor">2.2
|
|
Branches that may be out of scope</a></h3>
|
|
|
|
<ol class="enumar">
|
|
<li>Browser Exploits</li>
|
|
|
|
<li>Man in the Middle (MITM) attacks</li>
|
|
|
|
<li>Malware/Spyware Attacks
|
|
|
|
<ol class="enumla">
|
|
<li>keyloggers</li>
|
|
|
|
<li>screen loggers</li>
|
|
|
|
<li>altering the users local DNS hostfile (sometimes
|
|
referred to as "pharming")</li>
|
|
|
|
<li>"transaction generator" - malware that hijacks a
|
|
legitimate login session to send requests or
|
|
transactions</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Credential database compromise
|
|
|
|
<ol class="enumla">
|
|
<li>Browser credential store</li>
|
|
|
|
<li>Server store
|
|
|
|
<ol class="enumlr">
|
|
<li>insider attacks</li>
|
|
|
|
<li>external breach</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Masquerading attack
|
|
|
|
<ol class="enumla">
|
|
<li>reuse of credentials to masquerade as user</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Dictionary Attacks
|
|
|
|
<ol class="enumla">
|
|
<li>online</li>
|
|
|
|
<li>offline</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Web timing attacks - using the time it takes a
|
|
website to respond to determine information about the
|
|
user (e.g., if they have an account at a particular
|
|
website)</li>
|
|
</ol>
|
|
</div>
|
|
|
|
<div class="div2">
|
|
<h3><a href="#Uncategorized_attacks" id=
|
|
"Uncategorized_attacks" name="Uncategorized_attacks" class=
|
|
"anchor">2.3 Uncategorized attacks</a></h3>
|
|
|
|
<p>This section serves as a repository for attacks that
|
|
have not yet been folded into the structure above.</p>
|
|
|
|
<ol class="enumar">
|
|
<li>Iframe attacks- are these covered by cross site
|
|
scripting above?
|
|
|
|
<ol class="enumla">
|
|
<li>attacker forces arbitrary URL to be displayed on
|
|
a visible iframe at legitimate page</li>
|
|
|
|
<li>attacker uses hidden iframe to inject content
|
|
into legitimate page, capture user input, etc</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>DNS attacks
|
|
|
|
<ol class="enumla">
|
|
<li>cache poisoning</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>Cryptographic attacks
|
|
|
|
<ol class="enumla">
|
|
<li>Attacks on the protocol (SSL/TLS)</li>
|
|
|
|
<li>Attacks on the encryption methods</li>
|
|
</ol>
|
|
</li>
|
|
|
|
<li>system take-over attacks (install something on the
|
|
system the user agent is running on which could be used
|
|
later)</li>
|
|
|
|
<li>Social Engineering Attacks (not covered above, but
|
|
these are within scope)
|
|
|
|
<ol class="enumla">
|
|
<li>Re-enrollment attack- convince user to re-enroll
|
|
their account or machine (e.g., to answer challenge
|
|
questions in sitekey)</li>
|
|
|
|
<li>Convince users they are already logged in</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</div>
|
|
|
|
<div class="div2">
|
|
<h3><a href="#HTTPS_Branch_of_threat_tree" id=
|
|
"HTTPS_Branch_of_threat_tree" name=
|
|
"HTTPS_Branch_of_threat_tree" class="anchor">2.4 HTTPS
|
|
Branch of threat tree</a></h3>
|
|
|
|
<ol class="enumar">
|
|
<li>Get certification authority to issue you a cert</li>
|
|
|
|
<li>Break public key in existing valid cert</li>
|
|
|
|
<li>Break SSL/TLS protocol</li>
|
|
|
|
<li>Prevent HTTPS from activating in the first place
|
|
|
|
<ol class="enumla">
|
|
<li>Intercept connections initiated via HTTP and
|
|
prevent redirect to HTTPS
|
|
|
|
<ul>
|
|
<li>Prevent protocol based redirect</li>
|
|
|
|
<li>Prevent any javascript based redirects</li>
|
|
|
|
<li>
|
|
<p>Rewrite any page contents containing
|
|
"<code>https://</code>" with
|
|
"<code>http://</code>"</p>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="div1">
|
|
<h2><a href="#Acknowledgements" id="Acknowledgements" name=
|
|
"Acknowledgements" class="anchor">3 Acknowledgements</a></h2>
|
|
|
|
<p>The material in this note was created by Tyler Close,
|
|
Rachna Dhamija, Johnathan Nightingale, and Stuart
|
|
Schechter.</p>
|
|
</div>
|
|
|
|
<div class="div1">
|
|
<h2><a href="#References" id="References" name="References"
|
|
class="anchor">4 References</a></h2>
|
|
|
|
<dl>
|
|
<dt class="label"><a name="ref-csrf" id=
|
|
"ref-csrf"></a>CSRF</dt>
|
|
|
|
<dd><a href=
|
|
"http://en.wikipedia.org/wiki/Cross-site_request_forgery"><cite>
|
|
Cross-Site Request Forgery</cite></a>, Wikipedia entry,
|
|
retrieved on 15 October 2007. Available at
|
|
http://en.wikipedia.org/wiki/Cross-site_request_forgery.</dd>
|
|
|
|
<dt class="label"><a name="ref-mspworm" id=
|
|
"ref-mspworm"></a>MSPWORM</dt>
|
|
|
|
<dd><a href=
|
|
"http://namb.la/popular/tech.html"><cite>Technical
|
|
explanation of the MySpace Worm</cite></a>, anonymous,
|
|
retrieved on 15 October 2007. Available at
|
|
http://namb.la/popular/tech.html .</dd>
|
|
|
|
<dt class="label"><a name="ref-securecode" id=
|
|
"ref-securecode"></a>SECURECODE</dt>
|
|
|
|
<dd><cite>Writing Secure Code</cite>, M. Howard, D.
|
|
LeBlanc. 2nd edition, Microsoft Press 2003.</dd>
|
|
|
|
<dt class="label"><a name="ref-wsc-usecases" id=
|
|
"ref-wsc-usecases"></a>WSC-USECASES</dt>
|
|
|
|
<dd><a href=
|
|
"http://www.w3.org/TR/2007/WD-wsc-usecases-20071101/"><cite>
|
|
Web Security Experience, Indicators and Trust: Scope and
|
|
Use Cases</cite></a>, T. Close, Editor, W3C Working Draft
|
|
(work in progress), 1 November 2007. This version is
|
|
http://www.w3.org/TR/2007/WD-wsc-usecases-20071101/. The
|
|
<a href="http://www.w3.org/TR/wsc-usecases/">latest
|
|
version</a> is available at
|
|
http://www.w3.org/TR/wsc-usecases/ .</dd>
|
|
|
|
<dt class="label"><a name="ref-wsc-xit" id=
|
|
"ref-wsc-xit"></a>WSC-XIT</dt>
|
|
|
|
<dd><a href=
|
|
"http://www.w3.org/TR/2007/WD-wsc-xit-20071101/"><cite>Web
|
|
Security Context: Experience, Indicators, and
|
|
Trust</cite></a>, T. Roessler, A. Saldhana, Editors, W3C
|
|
Working Draft (work in progress), 1 November 2007. This
|
|
version is http://www.w3.org/TR/2007/WD-wsc-xit-20071101/.
|
|
The <a href="http://www.w3.org/TR/wsc-xit/">latest
|
|
version</a> is available at http://www.w3.org/TR/wsc-xit/
|
|
.</dd>
|
|
|
|
<dt class="label"><a name="ref-xss" id=
|
|
"ref-xss"></a>XSS</dt>
|
|
|
|
<dd><a href=
|
|
"http://en.wikipedia.org/wiki/Cross_site_scripting"><cite>Cross
|
|
Site Scripting</cite></a>, Wikipedia entry, retrieved on 15
|
|
October 2007. Available at
|
|
http://en.wikipedia.org/wiki/Cross_site_scripting.</dd>
|
|
</dl>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>
|