Detecting malicious JavaScript code in Mozilla

Proceedings of the IEEE International Conference on Engineering of Complex Computer Systems, ICECCS

Volumn , Issue , 2005, Pages 85-94

  Hallaraker, Oystein ^a   Vigna, Giovanni ^a  

^a University of California   (United States)

Author keywords

JavaScript; Mobile Code; Web Applications

Indexed keywords

CLIENT SERVER COMPUTER SYSTEMS; CODES (SYMBOLS); EMBEDDED SYSTEMS; INFORMATION RETRIEVAL; PROBLEM SOLVING; PROGRAM INTERPRETERS; SECURITY OF DATA; WEB BROWSERS;

AUDITING; EMBEDDED INTERPRETERS; HIGH-LEVEL POLICIES; JAVASCRIPT LANGUAGE; MOBILE CODE; WEB APPLICATIONS;

JAVA PROGRAMMING LANGUAGE;

EID: 27144432843     PISSN: 27708527     EISSN: 27708535     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (16)

1. ECMA-262, ECMAScript language specification, 1999. http://www.ecma-international. org/publications/standards/Ecma-262.htm.
2. V. Anupam and A. J. Mayer. Secure Web Scripting. IEEE Internet Computing, 2(6):46-55, 1998. citeseer. ist. psu.edu/anupam98secure.html.
3. R. P. D. Peterson, M. Bishop. A flexible containment mechanism for executing untrusted code. 2002. http://nob.cs.ucdavis.edu/~bishop/ papers/2002-sandbox/2002-sandbox/2002%- sandbox.html.
4. I. C. P. D.Boswell, B.King. Creating Applications with Mozilla. September 2002. http://books.mozdev.org/chapters/.
5. I. O. Doug Turner. Creating XPCOM Components. December 2003. http://www.mozilla.org/projects/ xpcom/book/cxc/index.html.
6. B. Eich. Embedding the JavaScript Engine, A Bare Bones Tutorial. February 2000.
7. D. Flanagan. JavaScript: The Definitive Guide, 4th Edition. December 2001.
8. S. Furman. Java Method Overloading and LiveConnect 3. http://www.mozilla.org/js/liveconnect/ lc3_method_overloading.html.
9. F. Guisset. The Mozilla DOM hacking Guide, February 2004. http://www.mozilla.org/docs/dom/ mozilla/hacking.html.
10. R. Kemmerer and G. Vigna. Intrusion Detection: A Brief History and Overview. IEEE Computer, pages 27-30, April 2002. Special publication on Security and Privacy.
11. J. T. Moore. Mobile Code Security Techniques. Technical Report MS-CIS-98-28, 1998. citeseer.ist.psu. edu/moore98mobile.html.
12. mozilla.org. JavaScript C Engine Embedders's Guide.
13. J. K. Ousterhout, J. Y. Levy, and B. B. Welch. The Safe-Tcl security model. Lecture Notes in Computer Science, 1419:217-, 1998. citeseer.ist.psu.edu/ousterhout97safetc1.html.
14. D. A. Wagner. Janus: an Approach for Confinement of Untrusted Applications. Technical Report CSD-99-1056, December 1999.
15. R. Wahbe, S. Lucco, T. E. Anderson, and S. L. Graham. Efficient software-based fault isolation. ACM SIGOPS Operating Systems Review, 27(5):203-216, December 1993. citeseer.ist.psu.edu/wahbe93efficient. html.
16. L. Wood. Document Object Model (DOM) Level 1 Specification. Technical Report REC-DOM-Level-1-19981001. W3 Consortium, 1998. Version 1.0.