Model-Based Detection of CSRF - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2014

Model-Based Detection of CSRF

Résumé

Cross-Site Request Forgery (CSRF) is listed in the top ten list of the Open Web Application Security Project (OWASP) as one of the most critical threats to web security. A number of protection mechanisms against CSRF exist, but an attacker can often exploit the complexity of modern web applications to bypass these protections by abusing other flaws. We present a formal model-based technique for automatic detection of CSRF. We describe how a web application should be specified in order to facilitate the exposition of CSRF-related vulnerabilities. We use an intruder model, à la Dolev-Yao, and discuss how CSRF attacks may result from the interactions between the intruder and the cryptographic protocols underlying the web application. We demonstrate the effectiveness and usability of our technique with three real-world case studies.
Fichier principal
Vignette du fichier
978-3-642-55415-5_3_Chapter.pdf (4 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01370351 , version 1 (22-09-2016)

Licence

Paternité

Identifiants

Citer

Marco Rocchetto, Martín Ochoa, Mohammad Torabi Dashti. Model-Based Detection of CSRF. 29th IFIP International Information Security Conference (SEC), Jun 2014, Marrakech, Morocco. pp.30-43, ⟨10.1007/978-3-642-55415-5_3⟩. ⟨hal-01370351⟩
89 Consultations
296 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More