合作式跨網站指令碼攻擊之防禦機制

存在已久的跨網站指令碼 (XSS)攻擊一直以來都是網頁應用安全的嚴重威脅，尤其近年來結合了web 2.0資訊分享模式、Ajax動態網頁技術和社交網路，XSS攻擊衍生出類似蠕蟲般具備自我複製能力的攻擊型態，不但在短時間內就能造成大量的客戶端使用者受到攻擊，受害的客戶端使用者對伺服器端產生的大量複製要求也形同對伺服器的分散式阻斷攻擊，因此對伺服器而言受害者也是攻擊者。傳統在伺服器端實施基於輸入輸出驗證的XSS防禦機制難以防禦XSS worm的擴散，因輸入驗證根據惡意指令碼特徵進行過濾，而XSS worm利用Javascript易於變形的特性來迴避伺服器端對於惡意指令碼特徵之偵測，本文提出新的合作式防禦架構，一方面由具備技術能力並瞭解所提供的網頁應用服務的特性的伺服器端定義安全規範協助客戶端使用者於瀏覽器執行指令碼安全性過濾，另一方面，客戶端使用者瀏覽器在偵測到XSS攻擊時，將此攻擊的訊息回報伺服器，伺服器可自動化將此攻擊資訊轉為網頁應用防火牆的規則，防止該XSS攻擊指令碼的下載，阻斷XSS worm大規模擴散，並提供網頁開發人員充裕的時間修補網頁應用程式原始碼中的弱點，在此合作式防禦架構中，客戶端安裝瀏覽器套件，利用瀏覽器套件強化瀏覽器的安全性；伺服器端安裝網頁應用防火牆，利用網頁應用防火牆強化網頁伺服器的安全性，雙方共同合作來抵抗XSS攻擊。

關鍵字

網頁安全；網頁應用防火牆；跨網站指令碼

並列摘要

XSS attack is long recognized as the major threat to the security of web applications. With the emergence of Web 2.0, Ajax and social networking, recent XSS attacks are able to induce massive assaults within a short time through worm-like self-reproduction.　Traditional defense based on server-side input-output validation is not able to stop them from spreading. In this thesis, we proposed a novel cooperative defense mechanism to solve the problem from both ends.　At the client side, customized security policy are supplied by the more knowledgeable web application provider to assist client-side malicious script filtering to protect the client from being compromised by attacks. At the server side, the detection incidences reported from the client are automatically utilized to enhance the server-side output-filtering rules which immediately stop the malicious scripts from spreading while a final remedy to the vulnerability is still being developed.

並列關鍵字

XSS ； web application security ； XSS worm

參考文獻

[9]. David Scott, Richard Sharp,“Abstracting application-level web security”,11th International World World Web Conference,2002

[21]. Apache , Apache HTTP Server, http://www.apache.org/

[27]. Oystein Hallaraker , Giovanni Vigna,“Detecting Malicious JavaScript Code in Mozilla”, 10th IEEE International Conference on Engineering of Complex Computer Systems 2005.

[29]. W3C, “Document Object Model (DOM)”,http://www.w3.org/DOM/

[38]. Yao-Wen Huang, Shih-Kun Huang, Tsung-Po Lin, and Chung-Hung Tsai,”Web application security assessment by fault injection and behavior monitoring”, Proceedings of the 12th International World Wide Web Conference (WWW 2003), May 2003.

國際替代計量

合作式跨網站指令碼攻擊之防禦機制

全文下載

主題瀏覽