webappsec.dev

$less ~/slides/csp-a-successful-mess

// deck 06 · LocoMocoSec

Content Security Policy

A successful mess between hardening and mitigation

LocoMocoSec · Kaua'i · 2019· 56 slides· Lukas Weichselbaum, Michele Spagnuolo

pdf ↓ 2.7 MB

  1. Slide 1: #LocoMocoSec Kauai, Hawaii 2019
  2. Slide 2: Lukas Weichselbaum Michele Spagnuolo
  3. Slide 3: Agenda
  4. Slide 4: Vulnerability Trends
  5. Slide 5: Total Google VRP Rewards (since 2014)
  6. Slide 6: Google VRP Rewards for Web Platform Bugs
  7. Slide 7: Source: HackerOne report, 2017
  8. Slide 8: Source: @jvehent, Mozilla (legend)
  9. Slide 9: The Need for Defense-in-Depth
  10. Slide 10: Mitigation ≠ Mitigation
  11. Slide 11: XSS blocked by CSP @Google
  12. Slide 12: CSP Coverage at Google
  13. Slide 13: Google Case Study: >60% of XSS Blocked by CSP
  14. Slide 14: Google Case Study: >60% of XSS Blocked by CSP (continued)
  15. Slide 15: On Very Sensitive Domains: ~80% of XSS Blocked by CSP
  16. Slide 16: Externally Reported XSS Exploited via
  17. Slide 17: Mapping Common XSS Sinks to CSP Features
  18. Slide 18: Step-by-Step Towards a Stronger CSP
  19. Slide 19: Why NOT a whitelist-based CSP?
  20. Slide 20: Recap: What is a nonce-based CSP
  21. Slide 21: Incremental Rollout of a nonce-based CSP
  22. Slide 22: Towards a Stronger nonce-based CSP (Level 1-4)
  23. Slide 23: soon
  24. Slide 24: soon (continued)
  25. Slide 25: soon (continued)
  26. Slide 26: soon (continued)
  27. Slide 27: soon (continued)
  28. Slide 28: soon (continued)
  29. Slide 29: soon (continued)
  30. Slide 30: soon (continued)
  31. Slide 31: soon (continued)
  32. Slide 32: soon (continued)
  33. Slide 33: XSS Attack Surface by CSP Type
  34. Slide 34: CSP Coverage at Google by Type (2018)
  35. Slide 35: CSP Coverage at Google by Type (excl. L2, 2019)
  36. Slide 36: CSP Types @Google (examples)
  37. Slide 37: CSP Types @Google by Domain Sensitivity (2019)
  38. Slide 38: Advanced CSP Techniques
  39. Slide 39: New in CSP3 - script-src-elem and script-src-attr
  40. Slide 40: v75
  41. Slide 41: v75 (continued)
  42. Slide 42: v75 (continued)
  43. Slide 43: v75 (continued)
  44. Slide 44: Double Policies - The Best of Both Worlds
  45. Slide 45: Double Policies - Example
  46. Slide 46: L5: Double Policy: separate whitelist + nonce-only
  47. Slide 47: L5: Double Policy: separate whitelist + nonce-only (continued)
  48. Slide 48: CSP Beyond XSS - What About <style> Injections?
  49. Slide 49: Productionizing CSP
  50. Slide 50: Meaningful CSP Reports
  51. Slide 51: Overview of CSP Fallbacks
  52. Slide 52: Fallbacks for Old Browsers
  53. Slide 53: Conclusions
  54. Slide 54: Wrapping up
  55. Slide 55: In Brief
  56. Slide 56: #LocoMocoSec Kauai, Hawaii 2019
1 / 56

// key slides

  1. 13The case study: 7 of 9 XSS blocked on the most sensitive domains
  2. 16Which sink each reported XSS used
  3. 22CSP levels L1 to L4: adoption effort against covered sinks
  4. 55The recommendation: nonce + strict-dynamic first, nonce-only later

// what you take away

  • A strict CSP blocked 60 to 80% of externally reported XSS at Google in 2018.
  • Automated tools bypass more than 95% of the web's allowlist CSPs.
  • Start with nonce plus 'strict-dynamic'; move to nonce-only once you control all JS.