Preventing web browsers from doing what attackers tell them to
Content Security Policy
I first mentioned Content Security Policy back in April 2009  as an experimental project. The good news is that WebKit-based browsers (Chrome and Safari), Gecko (Firefox, Thunderbird, and SeaMonkey) and Internet Explorer 10 have partial support . If you want to use it, you'll need to specify three headers to be on the safe side:
X-WebKit-CSP, which are used by various browsers and various versions.
If supported, however, the Content Security Policy supports extremely fine grained access permissions. You can specify from where resources like scripts, objects (plugins), stylesheets, images, media, frames, fonts, forms, and so on can be loaded and even specify a
report-uri that tells the web browser where to send information about policy violations. Thus, if a third-party website attempts to trigger a browser to loading protected content that is not permitted, you can in theory be informed by the client, which would allow you to track which sites are being used to attack you.
Unfortunately, most of these security headers are not widely used. For the top 1 million websites (according to Alexa), one report states that roughly 20,000 sites use the
X-Frame-Options header, about 4,000 use the
Access-Control-* headers, about 1,400 use the Strict Transport Security headers to enforce HTTPS, and approximately 100 use Content Security Policies . Saying that these security headers are not widely used is an understatement. Obviously, better support in clients would help, but one area in which support for these headers seems to be really lacking is in most web applications and frameworks. Much like SELinux and other security policies, they'll remain a niche item until things hit a critical mass.
- Chromium STS: http://dev.chromium.org/sts
- The X-Frame-Options response header: https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
- HTTP access control: https://developer.mozilla.org/en/docs/HTTP/Access_control_CORS
- "Web Browser Security" by Kurt Seifried, Linux Pro Magazine, April 2009, pg. 64: http://www.linuxpromagazine.com/Issues/2009/101/Security-Lessons
- Content Security Policy: https://www.owasp.org/index.php/Content_Security_Policy
- Security Headers on Top 1,000,000 Websites: March 2013 Report: http://www.veracode.com/blog/2013/03/security-headers-on-the-top-1000000-websites-march-2013-report/
Buy this article as PDF
New partnership will bring more and better CS training to US schools
Criminals offer online help over Tor network
Sophisticated malware is still present on Joomla and WordPress sites around the world.
Future versions of Ubuntu's code service will support the popular Git version control system used with Linux and other open source projects.
New release marks the arrival of AMD’s unified driver strategy.
A new study by IDC charts big changes in the big hardware market.
Azure CTO says Redmond has already considered the unthinkable.
Lead developer quells rumors that the Debian version is slated for center stage.
MSBuild is now just another GitHub project as Redmond continues its path to the light.
Malware could pass data and commands between disconnected computers without leaving a trace on the network.