API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web
Presenters detail vulnerability discovery and exploitation in API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web.
Summary
Overview: The 2016 WWDC saw the dawn of Apple Pay Web, an API that lets websites embed an Apple Pay button within their web-facing stores. Supporting it required a complex request flow, complete with client certificates and a custom session server. This proved detrimental, since Apple failed to caution against important side effects of taking in untrusted URLs. As a result, many new SSRF vulnerabilities entered the world. Worse yet, while they were exploitable and discoverable in similar ways, they were s
Key Topics: pread across distinct codebases in several programming languages, so could not be patched in any generic way. Apple is not alone - in the process of gluing the web together, Twilio, Salesforce, and others have all created similarly broad attack surfaces. When companies fail to take an honest, empathetic look at how clients will use a product, they shove along hidden security burdens. Those who integrate with an API have less context than those who create it, so are in a worse position to recognize these risks. Engineers have been talking about defensive programming for decades, but top companies still have trouble practicing it. In this talk
Takeaways: oftware, and introduce a powerful model for finding broad classes of bugs.
Related talks
IEEE Symposium on Security and Privacy·13 min
Presenters detail vulnerability discovery and exploitation in 591 Where URLs Become Weapons Automated Discovery of SSRF Vulnerabilities in Web Applications Sam.
Briefings·21 min
Fengyu Liu · YouKun Shi · Tian Chen · Bocheng Xiang · Junyao He · Qi Li · Guangliang Yang · Yuan Zhang · Min Yang
Microservice architecture has become increasingly popular for building scalable and maintainable applications.
Briefings·25 min
Pinji Chen · Jianjun Chen · Qi Wang · Mingming Zhang · Haixin Duan
Introduces the security implications of HTTP/2 server push and signed HTTP exchange (SXG) on the Same-Origin Policy (SOP), a fundamental web security mechanism designed to prevent cross-origin attacks.