CS 253 Web Security Youtube Pt2

Question 1

What is the purpose of UI Denial-of-service attacks?

Answer 1

1. You override the browser defaults - This is in order to make it harder to escape from the site.
2. You implement scareware - Implementing threats of virus or something to make the user buy a product or trapping them.
3. Trolling

Question 2

How many levels are the web APIs divided in when we talk about the level of restrictions they have?

Answer 2

Level 0, 1, 2 and 3

Question 3

What are the restrictions for Level 0 web APIs?

Answer 3

No restrictions. APIs can be used immediately and indiscriminately.

Question 4

What are some examples of web APIs with Level 0?

Answer 4

DOM, CSS,
window.move()
file download
hide mouse cursor

Question 5

What are the restrictions for Level 1 web APIs?

Answer 5

User interaction is required.

API cannot be used unless it is in response to a user’s action, like a click or a keypress.
Scrolling does not count for example.

Question 6

What are some examples of web APIs with Level 1?

Answer 6

Element.requestFullscreen()
navigator.vibrate()
Copy text to clipboard
Speech synthesis API
window.open()

Question 7

What are the restrictions for Level 2 web APIs?

Answer 7

User “engagement” is required.

API cannot be used until user demonstrates high engagement with a website.

Question 8

What are some examples of web APIs with Level 2?

Answer 8

Autoplay sound
Prompt to install website to homescreen

Question 9

What are the restrictions for Level 3 web APIs?

Answer 9

User permission is required.
API cannot be used until user grants explicit permission.

Question 10

What are some examples of web APIs with Level 3?

Answer 10

Camera, microphone, geolocation, USB, MIDI device access.

Question 11

What is tabnabbing?

Answer 11

Its an attack that consists in reloading the original tab after opening a new tab. This is possible because of the way window.open() works, which still points to the original tab.

When reloading that tab one can reload said tab into any given URL. This is specially useful for phishing attacks, because you can replace the previous page with an exact copy and simulate a logout scenario and showing a login form to the user.

Question 12

What are some tabnabbing defenses you can set up?

Answer 12

1. Add rel=”noopener” attribute to all a tag elements with target=”_blank” attribute

This will make window.opener to be null instead of pointing to our window.

2.Add the new HTTP header: Cross-Origin-Opener-Policy: same-origin

This makes it so the browser will use a separate OS Process to load the site.
This prevents cross-window attacks an process side-channel attacks by severing references to other browsing contexts.