[转载]Dynamic Pharming Attacks and the Locked Same-originpolicies for Web Brow

原始出处：http://www.eecs.berkeley.edu

Abstract
We describe a new attack against web authentication, which we call dynamic pharming. Dynamic pharming works by hijacking DNS and infecting the victim’s browser with malicious Javascript, which then exploits the name-based same-origin policy to hijack a legitimate session after authentication has taken place. As a result, the attack works regardless of the authentication scheme used. Dynamic pharming enables the adversary to eavesdrop on sensitive content, forge transactions, key log secondary passwords, etc. To counter dynamic pharming attacks, we propose two locked same-origin policies for web browsers.
In contrast to the legacy same-origin policy, which regulates cross-object access control in browsers using domain names, the locked same-origin policy enforces access using servers’ X.509 certificates and public keys. We show how our policies help two existing web authentication mechanisms, client-side SSL and SSL-only cookies, resist both pharming and stronger active attacks. Also, we present a deployability analysis of our policies based on a study of 14651 SSL domains. Our results suggest one of our policies can be deployed today and interoperate seamlessly with the vast majority of legacy web servers. For our other policy, we present a simple incrementally deployable “opt in” mechanism for legacy servers using policy files, and show how web sites can use policy files to support self-signed and untrusted certificates, shared subdomain objects, and key updates.