Wiping out CSRF
Building practical CSRF protection solutions that work with legacy code and modern web applications.
Summary
CSRF Problem Statement
CSRF remains elusive despite being well-known. Legacy code, legacy frameworks, and developer misunderstanding perpetuate vulnerabilities. Building solutions for any HTTP application is challenging.
Defense Primitives
The presentation introduces primitives and strategies for building CSRF solutions. Modern frameworks provide automatic solutions integrated into applications. However, many apps don't leverage these frameworks or use them incorrectly.
Comprehensive Protection
In-depth overview covers various reasons CSRF occurs and provides payload examples targeting specific issues and variations. Live demos show attacks and protections. Composing primitives into complete solutions addresses most CSRF cases.
Modern Solutions
Same Site Cookies represent a new extension potentially ending CSRF problems. The presentation shows how to layer prior solutions as graceful degradation for browsers not supporting modern mechanisms.
Related talks
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.
Village Interviews·< 1 min
A quick spotlight on the Bug Bounty Village highlighting collaborative hunting events, live hacking, and educational sessions at DEF CON 34.
CSIT Village·22 min
Poh Cai Min · Shawn Pang
Poh Cai Min and Shawn Pang examines grammar-based fuzzing made painless.