Web Services Security Attacks in Action (TS-5398)
Presented by Rich Salz from DataPower Technology.
Goal:
Understand some types of syntactic and semantic attacks for Web Services applications.
Definitions:
Syntactic attack: a "generic XML" attack
Semantic attack: leveraging the structure and rpocessing rules of SOAP, WS-xxx, or the payload
XDoS: because of XML (insanely large XML payloads, I assume).
Simple Syntactic Attacks:
Could be composed of random bits, not XML.
Simple Overflows:
DTD Syntax Attacks:
Simple Semantic Attacks:
Semantic Attack: Discovery:
Expose only what's neccessary. Service discovery is not a great idea, since WSDL could expose vulnerable functionality.
Semantic Attack: Distributed ID Monte:
Policy says that message body must be signed. Signature reference uses "URI-#body" to point to the body. Attacker moves the body into a SOAP header. So, the Body is signed, but a false Body is installed in the Header. Don't quite understand the details of this attack since it was poorly explained.