owasp gÖteborg · owasp gÖteborg september 2012 hybrid mobile apps & the evolving web by...
TRANSCRIPT
![Page 1: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/1.jpg)
OWASP GÖTEBORG
SEPTEMBER 2012
HYBRID MOBILE APPS & THE EVOLVING WEB
BY MIKKO SAARIO
(http://twitter.com/midisfi)
Twitter: @midisFI
![Page 2: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/2.jpg)
THIS IS NOT YOUR UNCLE OLOF'S "OWASP TOP 10 MOBILE SECURITY"
TALK
![Page 3: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/3.jpg)
![Page 4: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/4.jpg)
AGENDA1. Hybrid environments & the Open Web Platform
Hybrid environments mix HTML+JS with Native codeOWP + a peek into stuff like getUserMedia30 min or so
2. Case review from the mixed worldSecurity evaluation of a new multi-technology application10 min or so
3. Security and Agile development - do they mix?A bit of theoryAnd a bit of practice - 1st hand20 min or so
![Page 5: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/5.jpg)
Oh well
Almost got a'Bingo'
![Page 6: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/6.jpg)
MENokiaSecurity manager for Sales & Marketing servicesFounder of OWASP HelsinkiMotto: "the more you learn, the less you seem to know"More of a Defender & Breaker than a Builder
![Page 7: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/7.jpg)
POLL
![Page 8: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/8.jpg)
DISCLAIMER
ExamplesAre for Windows Phone 7.5with an odd Qt/QML one thrown in
Android and iPhone guys - just be cool
![Page 9: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/9.jpg)
TRADITIONAL AIR GAP
A PRETTY EFFECTIVE SECURITY CONTROL
![Page 10: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/10.jpg)
WEB HAD NO ACCESS TO DEVICE API
![Page 11: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/11.jpg)
![Page 12: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/12.jpg)
SECURITY USED TO BE
SIGNING APPS WITHCAPABILITIES
Permission, privilege, you name it...So, installation handled the "rights"
BUFFER OVERFLOWS
SMS OF DEATH
MALWARE
AND SO FORTH
![Page 13: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/13.jpg)
AND STILL IS...
THEY DIDN'T DISAPPEAR
![Page 14: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/14.jpg)
BRIDGING THE AIR GAP #1
NATIVE += WEB
HYBRID
![Page 15: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/15.jpg)
LET'S ADD A WEBVIEW
Code: Qt/QML
import QtWebKit 1.0
WebView { url: "https://www.owasp.org" preferredWidth: 490 preferredHeight: 400 scale: 0.5 smooth: false }
![Page 16: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/16.jpg)
MAGIC HAPPENS
![Page 17: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/17.jpg)
A HYBRID ENVIRONMENT
Native mobile apps utilize Web technologies inside the appHTML, CSS and JavaScript embedded in / utilized by native code (C#, VB, objective-C, C++, "java")
Typically utilizing
For the rest of us: a "WebBrowser", "uiWebView", or just plain "WebView"
Windows Phone 7: WebBrowser controlRendering engine without the "chrome" (Browser UI)
/(ui)?Web(View|Browser)/g class
![Page 18: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/18.jpg)
COMMON
Qt/QML multiplatformWidgetsAndroidMac OS X, iOSWindows OS / PhoneApache Cordova / PhoneGap
![Page 19: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/19.jpg)
NATIVE AND JS CAN TALK
Code: WinPhone 7 C#/Silverlight/XAML/JavaScript
In native, expose an interface to JS <phone:WebBrowser ScriptNotify="alert_ScriptNotify"IsScriptEnabled="True"
/>
Javascript calls the parent native app function AlertSilverlight(data){ window.external.notify(data);}
AlertSilverlight(1);
Listener picks it up and executes private void alert_ScriptNotify(object sender, NotifyEventArgs e)
{ MessageBox.Show(e.Value);}
![Page 20: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/20.jpg)
SECURITY FUNDAMENTALS
![Page 21: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/21.jpg)
OWASP TOP TEN
YES, IT'S ALL VERY VALID
BOTH OF THEM
![Page 22: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/22.jpg)
UI CONTROLSA lot of the usual UI controls are missing
E.g. WP7 will silently fail self-signed, untrusted SSL cert
No SSL "lock" visible
Warnings, popups etc.
![Page 23: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/23.jpg)
SAME ORIGIN POLICYNotes for Windows Phone 7
Content loaded from isolated storage is not restricted by SOP (file:///)Content created via NavigateToString is not restricted by SOP
JavaScript called via InvokeScript can be from any domainSome difference on desktop vs mobile
E.G. QT HAS SOP LIMITS ON FILE:///
var html = "<html><script> </script></html>"
webBrowser1.NavigateToString(html);
...code...
![Page 24: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/24.jpg)
EVAL IS STILL EVIL
ARE YOU EVAL'ING SOME INPUT?
eval(), setTimeout(), setInterval(), new Function()
![Page 25: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/25.jpg)
BUFFER OVERFLOWS
THE ABOVE KILLED N9 TWITTER CLIENT (QT & C++)
we can't know how much space we need to allocate... ...for this pathological string we are generating two glyphs for each character.
![Page 26: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/26.jpg)
INJECTIONSSQL injectionXML Query / XPath injection
Using XQuery or XPath dynamically with user-supplied input could leave you vulnerable in Qt
Use bound parameters
![Page 27: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/27.jpg)
DENIAL OF SERVICEIsolated storage on WP7 has no size restrictionsSo one app may fill up the whole storage space
![Page 28: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/28.jpg)
CONFIGURATIONSDefine your environment specs
Your mileage will vary greatly
Each framework has their own details
![Page 29: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/29.jpg)
SCRIPTING
/* Qt default: true */QWebSettings::JavascriptEnabled
QWebSettings::JavascriptCanOpenWindowsQWebSettings::JavascriptCanAccessClipboard
<!-- Windows Phone 7 default: disabled --><Grid x:Name="LayoutRoot"> <phone:WebBrowser Name="mybrowser" IsScriptEnabled="True" Source="index.html" ScriptNotify="pokeMyScript" /></Grid>
![Page 30: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/30.jpg)
PLUGINSJava, Flash and other plugins
/* Qt; No plugins in WP7 */QWebSettings::JavaEnabled QWebSettings::PluginsEnabled
![Page 31: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/31.jpg)
ETC.Configure cross-domain actions
Anything else that is configurable
QWebSettings::XSSAuditingEnabledQWebSettings::LocalContentCanAccessRemoteUrls QWebSettings::LocalContentCanAccessFileUrls/* can qrc:// access file:// */
QWebSettings::PrivateBrowsingEnabled QWebSettings::DeveloperExtrasEnabled
IsGeolocationEnabled = "true"
![Page 32: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/32.jpg)
DEMO TIME
A WP7 DEMO APP
![Page 33: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/33.jpg)
BRIDGING THE AIR GAP #2
OPEN WEB PLATFORM / HTML5
![Page 34: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/34.jpg)
OPEN WEB PLATFORMHTML5 (of course)Web APIsDOMCSSSVGMathMLWebRTCDevice APIsEcmaScript / JavaScriptHTTP, URIMedia Accessibility Checklistetc.
![Page 35: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/35.jpg)
WebRTCWEB REAL TIME COMMUNICATIONS
MediaStream (getUserMedia)Access to e.g. device camera and microphone
PeerConnection (peer-to-peer connections)Enables e.g. VoIP from browser to browser (using ICE + STUN & TURN servers)
...lets look at getUserMedia in a moment
![Page 36: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/36.jpg)
Web APIsClipboard APIFile APIFullscreenGamepadIndexed DBPointer LockWeb WorkersXHR2 (CORS) etc. etc. etc.
(https://wiki.mozilla.org/WebAPI)Boot to Gecko
![Page 37: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/37.jpg)
Device APIsBattery StatusCalendar APIContacts APIDevice Orientation APIGeolocation + level 2Media Capture (gone)Vibration API etc. etc.
![Page 38: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/38.jpg)
Remember the GoodOld Flash CameraSnooping Days?Are they coming back?
![Page 39: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/39.jpg)
getUserMediaHello, World!
img sou rce: http://safeandsavvy.f-secu re.com
![Page 40: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/40.jpg)
BLEEDING EDGE
CHROME 21
FIREFOX 16+
OPERA 12
OPERA MOBILE 12
{ ANDROID > SYMBIAN }
![Page 41: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/41.jpg)
NU SKA NI FÅ LÄRÄ ER LITE FINSKA
![Page 42: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/42.jpg)
CHROME 21
JA / NEJ
![Page 43: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/43.jpg)
OPERA 12
![Page 44: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/44.jpg)
FIREFOX 15
OOPS NO GO :)
Looks more like (http://alexandre.alapetite.fr/doc-alex/html5-webcam/)
FF 16 & 17
![Page 45: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/45.jpg)
DEMO2 TIME
GETUSERMEDIA ON A STANDARD BROWSER
![Page 46: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/46.jpg)
ANDROID 4.0 ICS
CHROME & NATIVE BROWSER: NO GO
![Page 47: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/47.jpg)
IFRAME CAMERA
W3C proposal & current implementation: -------------------------------------- In order to prevent unexpected behaviour and to stay on the safe side of user's privacy, it may be useful to explicitly mention in the specification that calls from s be silently denied. . . . "No conclusion"
(http://www.w3.org/wiki/Media_Capture#iFrame_behavior)
W3C site
![Page 48: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/48.jpg)
FILE API
SANDBOXED LOCAL FILESYSTEM
filesystem:http://localhost/temporary/
![Page 49: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/49.jpg)
DEMOVerkkosivu ei ole käytettävissä
Google Chrome ei voinut muodostaa yhteyttä osoitteeseen localhost. Sivusto voi olla pois
käytöstä tai verkon asetuksissa voi olla virhe.
Seuraavassa on joitakin ehdotuksia:
Päivitä tämä sivu myöhemmin.
Tarkista internetyhteytesi. Käynnistä uudelleen reititin, modeemi tai muut käytössä olevat
verkkolaitteet.
Kokeile lisätä Google Chrome sallittujen ohjelmien luetteloon palomuurisi tai
virustorjuntaohjelmasi asetuksissa. Jos ohjelma on jo sallittu, kokeile poistaa se sallittujen
ohjelmien luettelosta ja lisätä se sitten uudelleen.
Jos käytät välityspalvelinta, tarkista välityspalvelinasetukset tai ota yhteyttä verkon
ylläpitäjään ja varmista, että välityspalvelin toimii. Jos käytössä ei pitäisi olla
Verkkosivu ei ole käytettävissä
Google Chrome ei voinut muodostaa yhteyttä osoitteeseen localhost. Sivusto voi olla pois
käytöstä tai verkon asetuksissa voi olla virhe.
Seuraavassa on joitakin ehdotuksia:
Päivitä tämä sivu myöhemmin.
Tarkista internetyhteytesi. Käynnistä uudelleen reititin, modeemi tai muut käytössä olevat
verkkolaitteet.
Kokeile lisätä Google Chrome sallittujen ohjelmien luetteloon palomuurisi tai
virustorjuntaohjelmasi asetuksissa. Jos ohjelma on jo sallittu, kokeile poistaa se sallittujen
ohjelmien luettelosta ja lisätä se sitten uudelleen.
Jos käytät välityspalvelinta, tarkista välityspalvelinasetukset tai ota yhteyttä verkon
ylläpitäjään ja varmista, että välityspalvelin toimii. Jos käytössä ei pitäisi olla
![Page 50: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/50.jpg)
CHROME APPSApps run outside "chrome browser", no browser UIBut made with html, js & css"Offline", but appear like native appsQuite strict security model:
Mandatory strict CSPPrevents inline scripts, eval & "new Function()"Those can be used in a sandboxed (iframe) page<browser> tag to safely display web contentAccept permissions at installationEach window can have separate privileges (reduce attack surface)Process and storage isolationAccess ext content, but e.g. xhr requires whitelisting the site
New APIs to access OS: bluetooth, usb etc.
![Page 51: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/51.jpg)
END OF PART 1
![Page 52: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/52.jpg)
CASE STUDY
![Page 53: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/53.jpg)
AGILE
EXPERIENCES WITH AGILE TEAMS
![Page 54: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/54.jpg)
THEORY
Prou dly reu sed from: www.digdes.com
![Page 55: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/55.jpg)
KEY CONCEPTSEpics, user stories and featuresAbuse storiesSprint vs Product backlogSprint review & Definition of DoneTools, aides, etc.
![Page 56: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/56.jpg)
"OPERATIONAL TASKS"Security related work not related to user storiesThings like patches, scans, significant vulnerabilitiesExtra reviews of risky codeOften, but not always, goes into the backlog
![Page 57: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/57.jpg)
TEAMMain product dev teams in one placeThree scrum teamsTwo week sprintsTesting teamOps teamArchitect(s) + support functionsClient SDK teams "right-shored"Full-time security manager -> security architectOne of the devs was nominated as "security responsible"
![Page 58: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/58.jpg)
KEY CHALLENGESLots of historical baggage (known issues a.k.a. "technical/security debt")High pressure to push out new featuresAlso strong focus on availabilitySecurity on back burnerKeep security on the table continuously, not ad-hoc
![Page 59: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/59.jpg)
KEY ACTIVITIESEpics, stories, features were complemented with security reviews/discussionsArchitecture was out of band, more forward-lookingSecurity manager was changed to a security architect (possible due to attrition)Security sprints were conducted to "clear" a lot of old debtSprint backlog items were pre-munched for security aspects (had to have basic definition in place)Code scanning, vuln scanning etc. was end of sprint or out of bandSecurity audits, pentests, etc. were also out of bandTesting was both focused unit testing & broader integration testing (added sec cases)
![Page 60: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/60.jpg)
QUESTIONS?
![Page 61: OWASP GÖTEBORG · OWASP GÖTEBORG SEPTEMBER 2012 HYBRID MOBILE APPS & THE EVOLVING WEB BY MIKKO SAARIO ... A WP7 DEMO APP. BRIDGING THE AIR GAP #2 OPEN WEB PLATFORM / HTML5. OPEN](https://reader031.vdocuments.us/reader031/viewer/2022011903/5f1662d1e300a52e206d2521/html5/thumbnails/61.jpg)