PhD Positions in Web security (m/f/d) - Group Stock

at  CISPA HelmholtzZentrum fr Informationssicherheit gGmbH

ST. INGBERT, DEUTSCHLAND

Previous
Next
The Secure Web Applications Group conducts research in the area of Web Security in general. To familiarize yourself with the work our group does, please checkout this page.
Want to join the Secure Web Applications Group as a PhD student? Great! We have a challenge for you first, though.
There is a hip new portal for owl dating that is privacy-friendly. Owley Madison does not simply store your contacts on the server where they might get compromised, but instead uses client-side storage for ensure privacy. We know that you can send URLs to a victim user (through https://gameserver.websec.saarland/owley, use CAPTCHA SWAG{crawler}), but you will have to find a way to steal his secret. We know that he likes to share it in the chat with his favorite owl, so maybe there is something you can find out there?
Can you steal the flag that the crawler owl inputs to its Owley chat partner? You will have to install a keylogger on the chat page, but the creators made sure to put all the functionality on separate subdomains to defend against XSS, so it may be necessary to abuse a SOP relaxation mechanism to correctly place your payload.
Looking for some inspiration on what to do? Possibly this paper, that one, and finally not trusting the locals might be beneficial.
Once you have the solution, briefly explain how you achieved it and put the flag into your cover letter. Note that any applications without that flag will not be considered. In case of questions about the task, contact Ben Stock directly.

Please refer the Job description for details