We had a State security audit

[Garick Hamlin]

On Wed, Mar 06, 2013 at 01:05:51AM +0000, David Langenberg wrote:
> 
> On Mar 5, 2013, at 5:35 PM, "Bryan E. Wooten" <bryan.wooten at utah.edu>
>  wrote:
> 
> > All,
> > 
> > Last week we had an internal State security audit.
> > 
> > One of their tests was to copy our CAS login page and host it on their own
> > server We use CAS for our Shib authentication. They then sent an email to
> > many on campus with a link asking them to verify some information, which
> > started with a CAS login page. Even though Outlook marked the email a
> > potential phishing some people clicked the link and had their password
> > captured. Sigh.

You may want to look at CSP.

https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html

It is designed to prevent and detect injection of javascript.  This with some framebusting
may help.

Forms-based-auth has some fundamental limitations obviously.  An attacker can make
a pixel perfect copy of the login screen and fool most users in many cases, but
this can help address some attacks.

After dealing with the XSS / CRSF problems of course you still have to worry
about downgrade MiTM open-wireless-network attacks (everyplace has some sort of cafe
with open wireless nearby right?).  https everywhere might help a little here.
It has some downgrade protections, I believe.

I suppose one could try to find impose some policy based off the senders of an emails and
if it contained a "complex" link to a protected application (lots of hand waving here 
since the details are messy), but I don't know there really is a solution there that
has enough power to stop an attacker who could just tweak the email endlessly until
it got through.

I am glad people are doing these sorts of audits!  
Thanks for sharing.

Garick