Web Cache Deception attacks still impact websites with 'substantial user populations'

guest · Dec 16, 2019

Web Cache Deception attacks still impact websites with 'substantial user populations'
Two years after first being disclosed, web cache deception attacks impact 25 of today's most popular websites
December 16, 2019
https://www.zdnet.com/article/web-c...t-websites-with-substantial-user-populations/

Almost two years after first being documented, Web Cache Deception attacks are still a major issue, and they still impact many popular websites.
New academic research published this month reveals that 25 of the Alexa Top 5,000 websites are still impacted by Web Cache Deception (WCD) attacks.
WHAT IS A WEB CACHE DECEPTION ATTACK
Web Cache Deception attacks were first disclosed in February 2017. They were discovered by Omer Gil, a security researcher, and bug hunter.

The trick, Gil said, was for an attacker to convince a user to access a boobytrapped URL that had the following structure: [LEGITIMATE_DASHBOARD_URL]/[NON-EXISTENT_FILE]
If the user clicked and accessed one of these booby-trapped links, a website's CDN would cache the user's personal dashboard, along with all the data found inside, and store it on the website's public, front-facing CDN server.
Click to expand...

TESTING MORE SITES FOR WCD ATTACKS
They not only tested WCD attacks that relied on loading non-existent files, but also explored various other forms of malformed URLs [...]
In most cases, the websites were vulnerable due to improperly configured CDN caching rules, researchers said. However, the research team didn't fault CDN providers, but rather website operators.

"The empirical evidence we presented [...] suggests that configuring web caches correctly is not a trivial task," the research team said. "Moreover, the complexity of detecting and fixing a WCD vulnerability is disproportionately high compared to launching an attack."

ZDNet readers who'd like to learn more can consult the researchers' white paper, titled "Cached and Confused: Web Cache Deception in the Wild," which will be presented at the Usenix security conference next year, in August 2020.
Click to expand...

White paper: "Cached and Confused: Web Cache Deception in the Wild"
(PDF - 298 KB): https://sajjadium.github.io/files/usenixsec2020wcd_paper.pdf

guest · Feb 19, 2020

Web cache deception named top web hacking technique of 2019
February 18, 2020
https://portswigger.net/daily-swig/web-cache-deception-named-top-web-hacking-technique-of-2019

PortSwigger Web Security has released its annual rundown of the best web hacking techniques of 2019.
The 10 methods, chosen by a junction of community and expert panelists, are defined, predominately, by breathing new life into once dated techniques.

But the number one spot in 2019 went to the researchers that quantified the real-world impact of web cache deception (WCD) vulnerabilities for the first time.
“We were certainly surprised to take the top spot,” the team, which included Seyed Ali Mirheidari, Sajjad Arshad, Kaan Onarlioglu, Bruno Crispo, Engin Kirda, and William Robertson, told The Daily Swig.

Building on the original WCD technique initially documented by security researcher Omer Gil, the ‘Cache and Confused’ (PDF) team additionally showed how the method could be altered in multiple ways to perform a successful attack.
“We hope that this number one spot can help our work garner more attention from the wider security community and pave the way for speedy development of defense,” they said.
Click to expand...

Log in or Sign up

Web Cache Deception attacks still impact websites with 'substantial user populations'

guest Guest

guest Guest

Log in or Sign up

Web Cache Deception attacks still impact websites with 'substantial user populations'

guest Guest

guest Guest

Useful Searches