Abusing Bleeding Edge Web
Standards for AppSec Glory
Bryant Zadegan

Ryan Lester

Director, Application Security
The Advisory Board Company

CEO, Co-FounderCyph

keybase.io/bryant@eganist

hacker@linux.com@TheRyanLester• Does AppSec stuff,usually.
• Mentors security
startups, sometimes.
• “Mentors” others on
AppSec, occasionally.
• Paid a buck to make Steve
Ballmer dance, but justonce.

• Runs an E2EE
communication startup• Codes for an E2EE
communication startup• Ran QA automation at arocket factory• Got sued by Napster (andnot for piracy)

Bleeding Edge Web Standards
For Your (Ab)use, we'll talk about these:But Why?
• New standards are
frequently drafted.
• Many introduce
unforeseencomplications.
• Novel uses
encourage
futuretweaks.
Source: Harold & Kumar Go to White Castle

SRI• Validate resources beyond your trust (e.g. CDNs)<script
src="https://code.jquery.com/jquery.min.js"
integrity="sha256-[hash] sha256-[hash2]"
crossorigin="anonymous"
fallback-src="jquery.min.js"></script>• caniuse.com/subresource-integrity

SRI• Validate resources beyond your trust (e.g. CDNs)<script
src="https://code.jquery.com/jquery.min.js"
integrity="sha256-[hash] sha256-[hash2]"
crossorigin="anonymous"
x-sri-fallback="jquery.min.js"></script>• caniuse.com/subresource-integrity

BUILDER DEMO
heisenberg.co/srifallbackdemo/
Kneel to the demo gods

SOURCE (Simplified BSD)
github.com/cyph/sri-fallback
Do source gods even exist?

CSP• Combines semi-strict header with strict <meta>.
• Allows for pre-loading of trusted complex logic.
• Does not work for the verbs frame-ancestors,report-uri, or sandbox.
(We really like that name.)BUILDER DEMO
heisenberg.co/metacspdemo/
Fall on thy sword for the demo gods.

CSP
• Best for adapting a semi-recent application for
use with CSP.
• Application’s trusted static logic is allowed to
execute on initial load.
• Meta-Hardening prevents dynamic content
from potentially executing later on.

• This can breaksites. Use!

– (Chrome 46+ only; no reporting in Firefox 😐)
Public-Key-Pins:
max-age=5184000; includeSubdomains;
pin-sha256="az9AwClWuHM+fYV+d8Cv9B4sAwdcoUqj93omk18O/pc=";
pin-sha256="5UONcYAsFtYscIlFlm4+aodoL20RRHzGaOeoSNEZ+iA=";"https://report-uri.io/report/[id]/reportOnly"• caniuse.com/hpkp

Deliberate self-bricking via HPKP + Rapid Key Rotation.
Let's spend 20 minutes on how we can use this:– to enable in browser code signing– to control content changes and harden SRI.
– to enable nuanced web content blocking. (NetSec)– to track users…
– to be total jerks…
...in ways we shouldn't put in print.
(Thanks Jann Horn @ Cure53 for putting us onto this!)Wait, in-browser code signing? No extensions?

In theory.
In the last slide’s content pinning scheme, code signing
logic goes in the ServiceWorker.

This effectively gets us Trust On First Use for current andfuture code.

Why “In theory”? This sounds like it should work.
In fact, Cyph employs a mature, audited implementation ofexactly this.
However, it was considered so novel that we had to apply for apatent on it.
But, you can come close to this for free if you…

Control local storage updates! Harden SRI!
• Set HPKP max-age to count down to yourdeployment date.
• Rotate routinely.

Benefits:• Retain control of front-end content between
releases.
• Mitigate risks of SRI hash tampering serverside.

BUILDER DEMO
redskins.io
I don't believe in demo gods

Web Content Gateway e.g. [SomeVendor]?
Lock your users out of sites even when they're noton your network!
1. For flagged domains, set HPKP headers.
2. Optionally, Rotate keys weekly at the gateway.
Done! (By us disclosing it, is this now prior art? )Oh...

https://crt.sh/?id=19538258

Issuer:commonName

Subject:
commonName= VeriSign Class 3 Public
Primary Certification
Authority - G5=organizationalUnitName = Symantec Trust NetworkorganizationName= "Blue Coat Systems, Inc."

User tracking?
Well, we really shouldn't talk about this…

But since this is Black Hat...

…let's track users!

Pre-requisites:
Lots of (sub)domains to pin
Browsers that allow HPKP incognito
Rapid Key Rotation(Thanks! )Server-side• /set: Returns HPKP header• /check: No-op — no HPKP header, status code 200
Client-side (JavaScript)• Set new ID: Hit /set on random subset of domains• Check ID: Hit /check on all domains; note failures

BUILDER DEMO
cyph.wang
I don't believe in demo gods

Not implemented by Google.
We only ran the script in console.

Not implemented by Reddit.
We only ran the script in console.

Considerations:
Risk: DoSing tracker domains as a public service
1. Domain whitelist for your own tracker, or
2. App-issued and tracker-verified nonce if analytics is yourbusiness model.

The pattern described is similar to others here:
https://tools.ietf.org/html/rfc7469#section-5

SOURCE (New BSD)
github.com/cyph/hpkp-supercookie
Do source gods even exist?

…to be total jerks?
we really shouldn't talk about this…

Hat Tip
To Geller Bedoya, Jonn Callahan, Jann Horn and all of Cure53,
Samy Kamkar, Jim Manico, Mike McBryde, Jim Rennie and his superb legal skill,
Garrett Robinson, John Wilander, Doug Wilson, as well as the Chrome, Firefox,
and Let's Encrypt security teams for their contributions.

Thank You!
Bryant Zadegan

Ryan Lester

Director, Application Security
The Advisory Board Company

CEO, Co-FounderCyphkeybase.io/bryant@eganist

hacker@linux.com@TheRyanLester