Large-Scale Analysis &amp; Detection of Authentication Cross-Site Request Forgeries

Sudhodanan, Avinash; Carbone, Roberto; Compagna, Luca; Dolgin, Nicolas; Armando, Alessandro; Morelli, Umberto

doi:10.1109/eurosp.2017.45

Cited by 30 publications

(14 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This can be used for instance to steal confidential information that will be sent to Eve's account instead of Alice's account. We will not consider protection against login CSRF in this paper; we refer the interested reader to [34] for some recent results on the topic.…”

Section: ) Current Fixes and Mitigationsmentioning

confidence: 99%

“…For example, if a website defends against CSRF through the use of an unpredictable user identifier, then Alice's requests will be rejected in Bob's session. The use of two test accounts for CSRF detection has already been advocated in previous work [34] and is part of traditional manual testing strategies. 10 After installing Mitch in her browser, the security tester first navigates the website as Alice: for every HTTP request detected as sensitive, Mitch stores the content of the corresponding HTTP response.…”

Section: A Key Idea and Challengesmentioning

confidence: 99%

“…CSRF-checker [34] is a black-box detection tool for a class of CSRF vulnerabilities, called authentication CSRF, which affect web authentication and identity management. This class of CSRF vulnerabilities enables login CSRF attacks [2], which authenticate the victim as the attacker, as well as attacks which allow the attacker to take control of the victim's account.…”

Section: A Academic Softwarementioning

confidence: 99%

“…Robust defenses against CSRF are well-known [2], but still a significant number of modern web applications was shown to be vulnerable to this class of attacks [28], [34]. The main challenge to face when implementing protection against CSRF is that one has to strike a delicate balance between security and usability.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities

Calzavara

Conti

Focardi

et al. 2019

2019 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

Cross-Site Request Forgery (CSRF) is one of the oldest and simplest attacks on the Web, yet it is still effective on many websites and it can lead to severe consequences, such as economic losses and account takeovers. Unfortunately, tools and techniques proposed so far to identify CSRF vulnerabilities either need manual reviewing by human experts or assume the availability of the source code of the web application.In this paper we present Mitch, the first machine learning solution for the black-box detection of CSRF vulnerabilities. At the core of Mitch there is an automated detector of sensitive HTTP requests, i.e., requests which require protection against CSRF for security reasons. We trained the detector using supervised learning techniques on a dataset of 5,828 HTTP requests collected on popular websites, which we make available to other security researchers. Our solution outperforms existing detection heuristics proposed in the literature, allowing us to identify 35 new CSRF vulnerabilities on 20 major websites and 3 previously undetected CSRF vulnerabilities on production software already analyzed using a state-of-the-art tool.

show abstract

Section: ) Current Fixes and Mitigationsmentioning

confidence: 99%

Section: A Key Idea and Challengesmentioning

confidence: 99%

Section: A Academic Softwarementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities

Calzavara

Conti

Focardi

et al. 2019

2019 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

show abstract

“…Since its discovery in 2001 [36], CSRF vulnerabilities have been continuosly ranked as one of the top three security risks for web applications, along with cross-site scripting (XSS) and SQL injection (SQLi) [6,11,31]. Successful CSRF exploitations can result in illicit money transfers [43], user account takeover [38], or remote server-side command execution [19], to name only a few publicly documented cases. In the past, similar vulnerabilities have been discovered in many popular websites including Gmail [34], Netix [12], ING Direct [43], and, more recently, in Google, Skype, and Ali Express websites [38].…”

Section: Introductionmentioning

confidence: 99%

Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs

Pellegrino,

Johns,

Koch

et al. 2017

Preprint

View full text Add to dashboard Cite

Cross-Site Request Forgery (CSRF) vulnerabilities are a severe class of web vulnerabilities that have received only marginal attention from the research and security testing communities. While much e ort has been spent on countermeasures and detection of XSS and SQLi, to date, the detection of CSRF vulnerabilities is still performed predominantly manually.In this paper, we present Deemon, to the best of our knowledge the rst automated security testing framework to discover CSRF vulnerabilities. Our approach is based on a new modeling paradigm which captures multiple aspects of web applications, including execution traces, data ows, and architecture tiers in a uni ed, comprehensive property graph. We present the paradigm and show how a concrete model can be built automatically using dynamic traces. Then, using graph traversals, we mine for potentially vulnerable operations. Using the information captured in the model, our approach then automatically creates and conducts security tests, to practically validate the found CSRF issues. We evaluate the e ectiveness of Deemon with 10 popular open source web applications. Our experiments uncovered 14 previously unknown CSRF vulnerabilities that can be exploited, for instance, to take over user accounts or entire websites.

show abstract

Performance Impact of Misbehaving Voters

Alotaibi

Thomas

2018

Computer Performance Engineering

View full text Add to dashboard Cite

Large-Scale Analysis & Detection of Authentication Cross-Site Request Forgeries

Cited by 30 publications

References 11 publications

Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities

Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities

Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs

Performance Impact of Misbehaving Voters

Contact Info

Product

Resources

About