Skip to main content
SpringerLink
Log in
Book cover

European Symposium on Research in Computer Security

ESORICS 2020: Computer Security – ESORICS 2020 pp 23–41Cite as

Bulwark: Holistic and Verified Security Monitoring of Web Protocols

Part of the Lecture Notes in Computer Science book series (LNSC,volume 12308)

Abstract

Modern web applications often rely on third-party services to provide their functionality to users. The secure integration of these services is a non-trivial task, as shown by the large number of attacks against Single Sign On and Cashier-as-a-Service protocols. In this paper we present Bulwark, a new automatic tool which generates formally verified security monitors from applied pi-calculus specifications of web protocols. The security monitors generated by Bulwark offer holistic protection, since they can be readily deployed both at the client side and at the server side, thus ensuring full visibility of the attack surface against web protocols. We evaluate the effectiveness of Bulwark by testing it against a pool of vulnerable web applications that use the OAuth 2.0 protocol or integrate the PayPal payment system.

Keywords

  • Formal methods
  • Web security
  • Web protocols

L. Veronese—Now at TU Wien.

This is a preview of subscription content, access via your institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    The protocol in the figure closely follows the Facebook implementation; details might slightly vary for different TTPs.

  2. 2.

    https://gsuiteupdates.googleblog.com/2018/04/more-secure-sign-in-chrome.html.

  3. 3.

    https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API.

  4. 4.

    An origin is a triple including a scheme (HTTP, HTTPS, ...), a host (www.foo.com) and a port (80, 443, ...). Origins represent the standard web security boundary.

  5. 5.

    Bulwark is currently proprietary software at SAP: the tool could be made available upon request and an open-source license is under consideration.

  6. 6.

    We responsibly disclosed the issue to Overleaf and they fixed it before publication.

References

  1. Bulwark case studies. https://github.com/secgroup/bulwark-experiments

  2. Bulwark: holistic and verified security monitoring of web protocols (Technical report). https://secgroup.github.io/bulwark-experiments/report.pdf

  3. Van Acker, S., Sabelfeld, A.: JavaScript sandboxing: isolating and restricting client-side JavaScript. In: Aldini, A., Lopez, J., Martinelli, F. (eds.) FOSAD 2015-2016. LNCS, vol. 9808, pp. 32–86. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-43005-8_2

    CrossRef  Google Scholar 

  4. Bansal, C., Bhargavan, K., Maffeis, S.: Discovering concrete attacks on website authorization by formal analysis. In: CSF 2012. IEEE (2012)

    Google Scholar 

  5. Blanchet, B.: An efficient cryptographic protocol verifier based on prolog rules. In: CSFW 2001. IEEE (2001)

    Google Scholar 

  6. Blanchet, B.: Automatic verification of correspondences for security protocols. J. Comput. Secur. 17(4), 363–434 (2009)

    CrossRef  Google Scholar 

  7. Calzavara, S., Focardi, R., Maffei, M., Schneidewind, C., Squarcina, M., Tempesta, M.: WPSE: fortifying web protocols via browser-side security monitoring. In: USENIX Security 18. USENIX Association (2018)

    Google Scholar 

  8. Calzavara, S., Focardi, R., Squarcina, M., Tempesta, M.: Surviving the web: a journey into web session security. ACM Comput. Surv. 50(1), 1–34 (2017)

    CrossRef  Google Scholar 

  9. Carbone, R., Compagna, L., Panichella, A., Ponta, S.E.: Security threat identification and testing. In: ICST 2015. IEEE Computer Society (2015)

    Google Scholar 

  10. Compagna, L., dos Santos, D., Ponta, S., Ranise, S.: Aegis: automatic enforcement of security policies in workflow-driven web applications. In: CODASPY 2017. ACM (2017)

    Google Scholar 

  11. Fett, D., Küsters, R., Schmitz, G.: The web SSO standard OpenID connect: in-depth formal security analysis and security guidelines. In: CSF 2017. IEEE (2017)

    Google Scholar 

  12. Fett, D., Küsters, R., Schmitz, G.: A comprehensive formal security analysis of OAuth 2.0. CCS 2016. ACM (2016)

    Google Scholar 

  13. Guha, A., Krishnamurthi, S., Jim, T.: Using static analysis for ajax intrusion detection. In: WWW 2009. ACM (2009)

    Google Scholar 

  14. Hardt, D.: The OAuth 2.0 authorization framework. RFC 6749, October 2012

    Google Scholar 

  15. Li, W., Mitchell, C.J., Chen, T.: OAuthGuard: protecting user security and privacy with OAuth 2.0 and OpenID connect. In: SSR (2019)

    Google Scholar 

  16. Li, X., Xue, Y.: BLOCK: a black-bOx approach for detection of state violation attacks towards web applications. In: ACSAC 2011 (2011)

    Google Scholar 

  17. Lodderstedt, T., McGloin, M., Hunt, P.: OAuth 2.0 threat model and security considerations. RFC 6819, January 2013

    Google Scholar 

  18. Pellegrino, G., Balzarotti, D.: Toward black-box detection of logic flaws in web applications. In: NDSS (2014)

    Google Scholar 

  19. Pironti, A., Jürjens, J.: Formally-based black-box monitoring of security protocols. In: Massacci, F., Wallach, D., Zannone, N. (eds.) ESSoS 2010. LNCS, vol. 5965, pp. 79–95. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-11747-3_7

    CrossRef  Google Scholar 

  20. Sudhodanan, A., Armando, A., Carbone, R., Compagna, L.: Attack patterns for black-box security testing of multi-party web applications. In: NDSS (2016)

    Google Scholar 

  21. Sun, S.T., Beznosov, K.: The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems. In: CCS 2012. ACM (2012)

    Google Scholar 

  22. Wang, R., Chen, S., Wang, X., Qadeer, S.: How to shop for free online - security analysis of cashier-as-a-service based web stores. In: S&P. IEEE (2011)

    Google Scholar 

  23. Wang, R., Chen, S., Wang, X.: Signing me onto your accounts through Facebook and Google: a traffic-guided security study of commercially deployed single-sign-on web services. In: S&P 2012. IEEE (2012)

    Google Scholar 

  24. Wang, R., Zhou, Y., Chen, S., Qadeer, S., Evans, D., Gurevich, Y.: Explicating SDKs: uncovering assumptions underlying secure authentication and authorization. In: USENIX (2013)

    Google Scholar 

  25. Xing, L., Chen, Y., Wang, X., Chen, S.: InteGuard: toward automatic protection of third-party web service integrations. In: NDSS 2013 (2013)

    Google Scholar 

Download references

Acknowledgments

Lorenzo Veronese was partially supported by the European Research Council (ERC) under the European Unions Horizon 2020 research (grant agreement No. 771527-BROWSEC).

Author information

Authors and Affiliations

  1. Università Ca’ Foscari Venezia, Venezia, Italy

    Lorenzo Veronese & Stefano Calzavara

  2. SAP Labs France, Mougins, France

    Lorenzo Veronese & Luca Compagna

Authors
  1. Lorenzo Veronese
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Stefano Calzavara
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Luca Compagna
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Lorenzo Veronese .

Editor information

Editors and Affiliations

  1. University of Surrey, Guildford, UK

    Prof. Liqun Chen

  2. Purdue University, West Lafayette, IN, USA

    Prof. Ninghui Li

  3. Delft University of Technology, Delft, The Netherlands

    Kaitai Liang

  4. University of Surrey, Guildford, UK

    Prof. Steve Schneider

Rights and permissions

Reprints and Permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Veronese, L., Calzavara, S., Compagna, L. (2020). Bulwark: Holistic and Verified Security Monitoring of Web Protocols. In: Chen, L., Li, N., Liang, K., Schneider, S. (eds) Computer Security – ESORICS 2020. ESORICS 2020. Lecture Notes in Computer Science(), vol 12308. Springer, Cham. https://doi.org/10.1007/978-3-030-58951-6_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-58951-6_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-58950-9

  • Online ISBN: 978-3-030-58951-6

  • eBook Packages: Computer ScienceComputer Science (R0)

search

Navigation