TC: Small: Plugging Logic Loopholes in Hybrid Web Applications to Secure Web Commerce

随着第三方服务集成在混合Web应用程序中的日益流行，协调这些单独服务和Web客户端的复杂性带来了新的安全挑战。这种复杂性经常带来程序逻辑缺陷，这些缺陷可以被利用来导致不同服务的内部状态之间的不一致，从而导致这些应用程序内的安全控制失败。这项研究的初步研究调查了该问题对通过第三方收银员(如PayPal、Amazon Payments和Google Checkout)接受支付的在线商家的安全影响。它揭示了领先的商家应用程序、流行的在线商店和一家著名的支付服务提供商之间惊人的逻辑漏洞，这些漏洞可以被利用来以任意低价购买商品，在支付一件商品后免费购物，甚至完全避免付款。这些发现表明，对Web服务集成中的逻辑缺陷缺乏了解，令人担忧，迫切需要对这一重要问题进行重大研究。该项目致力于深入了解混合型Web应用程序中的逻辑缺陷所构成的安全威胁的范围和程度，以及导致此类漏洞的常见设计陷阱。基于这一认识，它将研究新的技术，以便于在开发商家软件时检测和修补这些漏洞，对其他方的应用程序进行安全分析，以及对商家网站进行黑盒测试。还将开发新的技术，使网络服务提供商能够更好地支持将其服务安全地整合到商家系统中，并自动检测利用网络交易中这些逻辑缺陷的企图。这项研究涉及行业合作者，也将有助于提高使用混合Web应用程序的其他领域的安全保护。

With the increasing popularity of third-party services integrated in hybrid web applications, come new security challenges posed by the complexity in coordinating these individual services and the web client. Such complexity often brings in program logic flaws that can be exploited to induce inconsistencies among different services' internal states, causing the security control within these applications to fail. A preliminary study of this research investigated the security implications of the problem to online merchants that accept payments through third-party cashiers (e.g., PayPal, Amazon Payments and Google Checkout). It revealed stunning logic loopholes within leading merchant applications, popular online stores and a prestigious payment service provider, which can be exploited to purchase an item at an arbitrarily low price, shop for free after paying for one item, or even completely avoid payment. These findings point to a disturbing lack of understanding of the logic flaws within the integrations of web services, and an urgent need for significant research efforts on this important problem. This project endeavors to gain an in-depth understanding about the scope and the magnitude of the security threat posed by the logic flaws in hybrid web applications and the common design pitfalls that lead to such vulnerability. Based upon this understanding, it will study novel technologies to facilitate detection and patching of these flaws when developing merchant software, security analysis of other parties' applications and black-box testing of merchant websites. New techniques will also be developed to enable web-service providers to better support secure integrations of their services into merchant systems, and to automatically detect the attempts to exploit these logic flaws in web transactions. This research involves industry collaborators and will also contribute to the improvement of security protection in other domains that utilize hybrid web applications.