Utrjevanje HTTP sej z odtisom brskalnika

• Main Author: Urbanc, Jan
• Other Authors: Bernik, Igor
• Format: Bachelor Thesis
• Language: Slovenian
• Published: J. Urbanc 2015
• Subjects: internet; HTTP seje; spletne aplikacije; varnost; diplomske naloge; info:eu-repo/classification/udc/004.738.5(043.2); sami
• Online Access: https://dk.um.si/IzpisGradiva.php?id=46839; https://dk.um.si/Dokument.php?id=71290&dn=; https://plus.si.cobiss.net/opac7/bib/2951658?lang=sl

HTTP predstavlja osnovni gradnik sodobnega interneta. Je protokol, preko katerega dostopamo do vsebin, ki so sestavni del našega vsakdana. Zavedati se moramo, da je bil sam protokol zastavljen na zelo preprostih predpostavkah. Iz potrebe po identifikaciji uporabnika napram spletnim aplikacijam, je bil v HTTP vpeljan koncept stanja v obliki HTTP sej. Vpeljava stanja je edini način, da spletne aplikacije uporabniku lahko nudijo prilagojene vsebine glede na to, kdo vsebine zahteva. Od samega začetka te vpeljave se pojavljajo težave, katere imajo velikokrat za posledico varnostne ranljivosti, s katerimi lahko napadalec, z nekaj relativno preprostimi prijemi, prevzame sejo nekoga drugega. Posledično lahko tak napadalec dostopa do vsebin namenjenih nekomu drugemu. Tehnike za pridobitev odtisa brskalnika so znane nekaj let. Temeljijo na zamisli, da lahko od sodobnega brskalnika na ne-interaktiven način pridobimo zadostno količino informacij in podatkov, da ga lahko identificiramo med velikim številom drugih brskalnikov. Tehnike se vestno poslužujejo spletni oglaševalci in ostala spletna mesta, ki želijo brskalnikom, torej dejansko uporabnikom, slediti, ne da bi se posluževali očitnih metod sledenja, kot je raba piškotkov. V nalogi predstavljamo implementacijo, s katero lahko tehnike za pridobitev odtisa brskalnika uporabimo v prid varnosti spletnih aplikacij. To dosežemo tako, da HTTP seje z odtisom brskalnika utrdimo, ter preprečimo njihovo zlorabo z do zdaj znanimi tehnikami zlorabe tudi takrat, kadar ima napadalec dostop do podatkov o sami seji. HTTP is one of the basic building blocks of today's internet. As a protocol, it is responsible for streaming numerous types of content into our everyday. However, it was concieved and implemented on rather simple assumptions. The notion of state, the ability to identify users, was introducted into the protocol at a later stage, in the form of HTTP sessions. The introduction of state was the only mechanism that enabled web applications to serve customized content to users, depending on their identities. This change has been plagued with problems ever since. In many cases, these problems lead to security vulnerabilities, which could be exploited in ways that allow attackers to hijack user sessions and access others' content. Browser fingerprinting has been a well-known concept for a few years. It is based on the notion, that it is possible to gather enough distinct information from a specific browser, to be able to identifiy it among a large number of peers. The technique is widely used among web advertisers and web sites, who want to track their visitors without resorting to obvious and noisy tracking methods, such as using cookies. In this thesis, we will introduce the idea of using browser fingerprinting methods to harden sessions in web applications. If implemented, our technique will prevent the hijacking and misuse of sessions even in the event of an attacker knowing a session's details.