2018年点亮你的火把-网络安全人才培养点滴感悟.pdf

1、?-?2?G?M?0?TSQIG?cd?E?LJN?l?1?A?9?C?9?9?A?4?a?G?iI?RH?h?We?9?0?,?,?/?0,?00,?4?C/?SP?H?h?We?t?0?,?,?01,2?g?sr?DkF?i?,1?-2?9?t?y?iGC?y?k?k?I?g?sr?i?Dk?k?U?k?T?v?srT?e?an?7o?6?IN?6w?E?6?G?D?S?k?e?0?0?6?Sn?X?c?U?0?4?P?5?,1?1?2?C?S?,?2?0?5?6?3?0?03?6?-?0https:/ error page:e.g.,502-server-not-found,other

2、4xx/5xx response;Script in error page runs in https:/.?,Pretty Bad Proxy,S&P 2009browserPBPBankserverhttps:/502:Server not foundhttps:/?,Cookies Lack Integrity,USENIX15?Set-Cookie:UID=Alice;SecureCookie:UID=CookiesUID=AliceA Secure Flag doesnt protect Integrity!UID=MalloryHTTP Set-Cookie:UID=Mallory

3、HTTP RequestBHTTPS OnlySecureCookie:UID=Mallory?03?Injecting cookies into HTTPS can cause serious attacks such asaccount hijacking?Gmail?16HTTPSReplace your friendlist in Gmail/Gtalkwith hackersHTTP?5?5?1?As suggested in our USENIX paper,Google can investigate how frequently HTTP URLs set or overwri

4、te secure cookies,with the hops that to disable this functionality.?NDSS16?Idea?victim.COM?CDN?attacker.COM?Host of Trouble,CCS 2016,?NSA.GOVCache/PCDNHTTP Request:GET http:/NSA.GOV/path HTTP/1.1Host:ATTACKER.comMiddle box Confused:NSA or ATTACKER?/?24?NSA?98%?26?(CDN)?CDN?CDN?27?29?CDN?Internet?CDN?