Security - Introduction to Java Script - Lecture Slides, Slides of Javascript programming

Download Security - Introduction to Java Script - Lecture Slides and more Slides Javascript programming in PDF only on Docsity!

JavaScript Security

Living in a powder keg and giving off sparks

• JavaScript security is a mess
• The security model is outdated
• Key examples
• Attacking DNS to attack JavaScript
• What are we going to do?

The Death of the PC

• If all your documents are in the cloud, what good is protecting your PC?
• The JavaScript sandbox does nothing to prevent cloud attacks
• Who cares if a web site is prevented from reading your “My Documents”: it’s empty

The Same Origin Policy

• Scripts running on one page can’t interact with other pages
• For example, scripts loaded by jgc.org can’t access virusbtn.com
• But the Same Origin Policy doesn’t apply to the scripts themselves

Multiple

JavaScript Global Object

• JavaScript is inherently a ‘global’ language
• Variables have global scope
• Functions have global scope
• Objects inherit from a global object

JavaScript is everywhere

• -

Cross-Site Request Forgery

• Hijack cookies to use a session for bad purposes
• Enhance with JavaScript for complex transactions.

CSRF Example: Google Mail

• Steal authenticated user’s contact http://docs.google.com/data/contacts?out=js&sh ow=ALL&psort=Affinity&callback=google&max= 9 google ({ Success: true, Errors: [], Body: {…