Chris K. Karlof and Umesh Shankar and Doug Tygar and David Wagner

EECS Department, University of California, Berkeley

Technical Report No. UCB/EECS-2007-52

May 14, 2007

http://www2.eecs.berkeley.edu/Pubs/TechRpts/2007/EECS-2007-52.pdf

We describe a new attack against web authentication, which we call dynamic pharming. Dynamic pharming works by hijacking DNS and infecting the victim's browser with malicious Javascript, which then exploits the name-based same-origin policy to hijack a legitimate session after authentication has taken place. As a result, the attack works regardless of the authentication scheme used. Dynamic pharming enables the adversary to eavesdrop on sensitive content, forge transactions, key log secondary passwords, etc. To counter dynamic pharming attacks, we propose two locked same-origin policies for web browsers. In contrast to the legacy same-origin policy, which regulates cross-object access control in browsers using domain names, the locked same-origin policy enforces access using servers' X.509 certificates and public keys. We show how our policies help two existing web authentication mechanisms, client-side SSL and SSL-only cookies, resist both pharming and stronger active attacks. Also, we present a deployability analysis of our policies based on a study of 14651 SSL domains. Our results suggest one of our policies can be deployed today and interoperate seamlessly with the vast majority of legacy web servers. For our other policy, we present a simple incrementally deployable ``opt in'' mechanism for legacy servers using policy files, and show how web sites can use policy files to support self-signed and untrusted certificates, shared subdomain objects, and key updates.

---

BibTeX citation:

@techreport{Karlof:EECS-2007-52,
    Author= {Karlof, Chris K. and Shankar, Umesh and Tygar, Doug and Wagner, David},
    Title= {Dynamic pharming attacks and the locked same-origin policies for web browsers},
    Year= {2007},
    Month= {May},
    Url= {http://www2.eecs.berkeley.edu/Pubs/TechRpts/2007/EECS-2007-52.html},
    Number= {UCB/EECS-2007-52},
    Abstract= {We describe a new attack against web authentication, which we call dynamic pharming. Dynamic pharming works by hijacking DNS and infecting the victim's browser with malicious Javascript, which then exploits the name-based same-origin policy to hijack a legitimate session after authentication has taken place. As a result, the attack works regardless of the authentication scheme used. Dynamic pharming enables the adversary to eavesdrop on sensitive content, forge transactions, key log secondary passwords, etc. To counter dynamic pharming attacks, we propose two locked same-origin policies for web browsers. In contrast to the legacy same-origin policy, which regulates cross-object access control in browsers using domain names, the locked same-origin policy enforces access using servers' X.509 certificates and public keys.  We show how our policies help two existing web authentication mechanisms, client-side SSL and SSL-only cookies, resist both pharming and stronger active attacks. Also, we present a deployability analysis of our policies based on a study of 14651 SSL domains. Our results suggest one of our policies can be deployed today and interoperate seamlessly with the vast majority of legacy web servers. For our other policy, we present a simple incrementally deployable ``opt in'' mechanism for legacy servers using policy files, and show how web sites can use policy files to support self-signed and untrusted certificates, shared subdomain objects, and key updates.},
}

EndNote citation:

%0 Report
%A Karlof, Chris K. 
%A Shankar, Umesh 
%A Tygar, Doug 
%A Wagner, David 
%T Dynamic pharming attacks and the locked same-origin policies for web browsers
%I EECS Department, University of California, Berkeley
%D 2007
%8 May 14
%@ UCB/EECS-2007-52
%U http://www2.eecs.berkeley.edu/Pubs/TechRpts/2007/EECS-2007-52.html
%F Karlof:EECS-2007-52