Tweet
Dongsung Kim - The CSRF Resurrections! Starring the Unholy Trinity: Service Worker of PWA, SameSite of HTTP Cookie, and Fetch
Dongsung Kim, IT-Security Expert, Truesec, He/him
Presentation Title: The CSRF Resurrections! Starring the Unholy Trinity: Service Worker of PWA, SameSite of HTTP Cookie, and Fetch
Length of presentation: 45 minutes
Demo, Exploit
CSRF is (really) dead. SameSite killed it. Browsers protect us. Lax by default!
Sounds a bit too good to be true, doesn't it? We live in a world where browsers get constantly updated with brand new web features and new specifications. The complexity abyss is getting wider and deeper. How do we know web technologies always play perfectly nice with each other? What happens when something slips?
In this talk, I focus on three intertwined web features: HTTP Cookie's SameSite attribute, PWA's Service Worker, and Fetch. I will start by taking a look at how each feature works in detail. Then, I will present how the three combined together allows CSRF to be resurrected, bypassing the SameSite's defense. Also, I will demonstrate how a web developer can easily introduce the vulnerability to their web apps when utilizing popular libraries. I will end the talk by sharing the complex disclosure timeline and the difficulty of patching the vulnerability due to the interconnected nature of web specifications.
SPEAKER BIO:
Dongsung (Donny) Kim is a security specialist at Truesec || an independent software developer. His software interests vary widely from frontend to DevSecOps, with research interests spanning from reverse engineering to web security. Equipped with both professional and academic experiences, he wants to reconcile two seemingly opposite ideas: understanding user-facing software problems without compromising security.
Twitter: @kid1ng
Website: https://kidi.ng
---
REFERENCES:
[1] https://chromestatus.com/features
[2] https://www.blackhat.com/asia-19/bri...okie-jar-13805
[3] https://blog.mozilla.org/security/20...timing-attack/
[4] https://defcon.org/html/defcon-25/dc...rs.html#Rozner
[5] https://datatracker.ietf.org/doc/dra...-same-site/00/
[6] https://web.dev/samesite-cookies-explained/
[7] https://scotthelme.co.uk/csrf-is-really-dead/
[8] https://web.dev/progressive-web-apps/
[9] https://web.dev/offline-fallback-page/
[10] https://web.dev/service-worker-cachi...-http-caching/
[11] https://developer.chrome.com/docs/wo...gies-overview/
[12] https://developer.chrome.com/docs/wo...rkbox-routing/
[13] https://create-react-app.dev/docs/ma...ssive-web-app/
[14] https://fetch.spec.whatwg.org
[15] https://w3c.github.io/ServiceWorker/
[16] https://datatracker.ietf.org/doc/dra...is-rfc6265bis/
[17] https://crbug.com/1115847
[18] https://crbug.com/1241188
[19] https://github.com/w3c/ServiceWorker/issues/1604
[20] https://github.com/whatwg/fetch/pull/1345
[21] https://chromereleases.googleblog.co...r-desktop.html
[22] https://github.com/web-platform-test...commit/bfe98d4
[23] https://github.com/GoogleChrome/workbox/commit/f83fbc0
Dongsung Kim, IT-Security Expert, Truesec, He/him
Presentation Title: The CSRF Resurrections! Starring the Unholy Trinity: Service Worker of PWA, SameSite of HTTP Cookie, and Fetch
Length of presentation: 45 minutes
Demo, Exploit
CSRF is (really) dead. SameSite killed it. Browsers protect us. Lax by default!
Sounds a bit too good to be true, doesn't it? We live in a world where browsers get constantly updated with brand new web features and new specifications. The complexity abyss is getting wider and deeper. How do we know web technologies always play perfectly nice with each other? What happens when something slips?
In this talk, I focus on three intertwined web features: HTTP Cookie's SameSite attribute, PWA's Service Worker, and Fetch. I will start by taking a look at how each feature works in detail. Then, I will present how the three combined together allows CSRF to be resurrected, bypassing the SameSite's defense. Also, I will demonstrate how a web developer can easily introduce the vulnerability to their web apps when utilizing popular libraries. I will end the talk by sharing the complex disclosure timeline and the difficulty of patching the vulnerability due to the interconnected nature of web specifications.
SPEAKER BIO:
Dongsung (Donny) Kim is a security specialist at Truesec || an independent software developer. His software interests vary widely from frontend to DevSecOps, with research interests spanning from reverse engineering to web security. Equipped with both professional and academic experiences, he wants to reconcile two seemingly opposite ideas: understanding user-facing software problems without compromising security.
Twitter: @kid1ng
Website: https://kidi.ng
---
REFERENCES:
[1] https://chromestatus.com/features
[2] https://www.blackhat.com/asia-19/bri...okie-jar-13805
[3] https://blog.mozilla.org/security/20...timing-attack/
[4] https://defcon.org/html/defcon-25/dc...rs.html#Rozner
[5] https://datatracker.ietf.org/doc/dra...-same-site/00/
[6] https://web.dev/samesite-cookies-explained/
[7] https://scotthelme.co.uk/csrf-is-really-dead/
[8] https://web.dev/progressive-web-apps/
[9] https://web.dev/offline-fallback-page/
[10] https://web.dev/service-worker-cachi...-http-caching/
[11] https://developer.chrome.com/docs/wo...gies-overview/
[12] https://developer.chrome.com/docs/wo...rkbox-routing/
[13] https://create-react-app.dev/docs/ma...ssive-web-app/
[14] https://fetch.spec.whatwg.org
[15] https://w3c.github.io/ServiceWorker/
[16] https://datatracker.ietf.org/doc/dra...is-rfc6265bis/
[17] https://crbug.com/1115847
[18] https://crbug.com/1241188
[19] https://github.com/w3c/ServiceWorker/issues/1604
[20] https://github.com/whatwg/fetch/pull/1345
[21] https://chromereleases.googleblog.co...r-desktop.html
[22] https://github.com/web-platform-test...commit/bfe98d4
[23] https://github.com/GoogleChrome/workbox/commit/f83fbc0