The multi-principal OS construction of the gazelle web browser

Proceedings of the 18th USENIX Security Symposium

Volumn , Issue , 2009, Pages 417-432

  Wang, Helen J ^a   Grier, Chris ^b   Moshchuk, Alexander ^c   King, Samuel T ^b   Choudhury, Piali ^a   Venter, Herman ^a  

^a MICROSOFT RESEARCH   (United States)

^b UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

^c UNIVERSITY OF WASHINGTON   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

WEBSITES;

ACCEPTABLE PERFORMANCE; DYNAMIC WEB APPLICATIONS; OPERATING ENVIRONMENT; PROTECTION DOMAINS; PROTOTYPE IMPLEMENTATIONS; RESOURCE PROTECTION; SYSTEM CONSTRUCTION; SYSTEM RESOURCES;

WEB BROWSERS;

EID: 77954608267     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (48)

1. Changes in allowScriptAccess default (Flash Player). http://www.adobe.com/go/kb403183.
2. Developer center: Security changes in Flash Player 7. http://www.adobe.com/devnet/flash/articles/fplayer_security.html.
3. Security advisories for Firefox 2.0. http://www.mozilla.org/security/known- vulnerabilities/ firefox20.html.
4. .NET Framework Developer Center, 2008. http://msdn.microsoft.com/en- us/netframework/ default.aspx.
5. Alexa, 2009. http://www.alexa.com/.
6. M. Barnett, K. Rustan, M. Leino, and W. Schulte. The Spec# programming system: An overview. In LNCS, editor, CAS-SIS, volume 3362. Springer, 2004. http://research.microsoft.com/en-us/projects/specsharp/.
7. A. Barth and C. Jackson. Protecting browsers from frame hijacking attacks, April 2008. http://crypto.stanford.edu/websec/frames/navigation/.
8. A. Barth, C. Jackson, and J. C. Mitchell. Securing frame communication in browsers. In In Proceedings of the 17th USENIX Security Symposium (USENIX Security), 2008.
9. A. Barth, C. Jackson, C. Reis, and T. G. C. Team. The security architecture of the Chromium browser, 2008. http://crypto.stanford.edu/websec/chromium/chromium-security-architecture.pdf.
10. S. Chen, D. Ross, and Y.-M. Wang. An Analysis of Browser Domain-Isolation Bugs and A Light-Weight Transparent Defense Mechanism. In Proceedings of the ACM Conference on Computer and Communications Security, 2007.
11. R. S. Cox, J. G. Hansen, S. D. Gribble, and H. M. Levy. A Safety-Oriented Platform for Web Applications. In Proceedings of the IEEE Symposium on Security and Privacy, 2006.
12. D. Crockford. JSONRequest. http://www.json.org/jsonrequest.html.
13. D. Crockford. The Module Tag: A Proposed Solution to the Mashup Security Problem. http://www.json.org/module.html.
14. Document Object Model. http://www.w3.org/DOM/.
15. J. R. Douceur, J. Elson, J. Howell, and J. R. Lorch. Leveraging legacy code to deploy desktop applications on the web. In Proceedings of the Symposium on Operating Systems Design and Implementation, 2008.
16. Firefox 3 for developers, 2008. https://developer.mozilla.org/en/Firefox_3_for_developers.
17. Mozilla Browser and Mozilla Firefox Remote Window Hijacking Vulnerability, 2004. http://www.securityfocus.com/bid/11854/.
18. Security Advisories for Firefox 2.0. http://www.mozilla.org/security/known- vulnerabilities/ firefox20.html.
19. D. Flanagan. JavaScript: The Definitive Guide. O’Reilly Media Inc., August 2006.
20. Adobe Flash Player 9 Security, July 2008. http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf.
21. C. Grier, S. Tang, and S. T. King. Secure web browsing with the OP web browser. In Proceedings of the 2008 IEEE Symposium on Securiy and Privacy, 2008.
22. J. Grossman. Advanced Web Attack Techniques using GMail. http://jeremiahgrossman.blogspot.com/2006/01/ advanced-web-attack-techniques-using.html.
23. W. H. A. T. W. Group. Web Applications 1.0, February 2007. http://www.whatwg.org/specs/web-apps/current-work/.
24. HTML 5 Editor’s Draft, October 2008. http://www.w3.org/html/wg/html5/.
25. What’s New in Internet Explorer 8, 2008. http://msdn.microsoft.com/en-us/library/cc288472.aspx.
26. Microsoft Internet Explorer Remote Window Hijacking Vulnerability, 2004. http://www.securityfocus.com/bid/ 11855.
27. S. Ioannidis and S. M. Bellovin. Building a secure web browser. In Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference, 2001.
28. S. Ioannidis, S. M. Bellovin, and J. M. Smith. Sub-operating systems: a new approach to application security. In Proceedings of the 10th workshop on ACM SIGOPS European workshop, pages 108–115, New York, NY, USA, 2002. ACM.
29. C. Jackson and A. Barth. Beware of Finer-Grained Origins. In Web 2.0 Security and Privacy, May 2008.
30. C. Jackson, A. Barth, A. Bortz, W. Shao, and D. Boneh. Protecting Browsers from DNS Rebinding Attacks. In Proceedings of ACM Conference on Computer and Communications Security, 2007.
31. JavaScript Object Notation (JSON). http://www.json.org/.
32. D. Kristol and L. Montulli. HTTP State Management Mechanism. IETF RFC 2965, October 2000.
33. T. W. Mathers and S. P. Genoway. Windows NT Thin Client Solutions: Implementing Terminal Server and Citrix MetaFrame. Macmillan Technical Publishing, Indianapolis, IN, November 1998.
34. IEBlog: IE8 Security Part V: Comprehensive Protection, 2008. http://blogs.msdn.com/ie/archive/2008/07/02/ie8- security- part- v- comprehensive-protection.aspx.
35. Microsoft security bulletin. http://www.microsoft.com/technet/security/.
36. Microsfot Security Intelligence Report, Volume 5, 2008. http://www.microsoft.com/security/portal/sir.aspx.
37. C. Reis and S. D. Gribble. Isolating web programs in modern browser architectures. In Proceedings of Eurosys, 2009.
38. T. Richardson, Q. Stafford-Fraser, K. R. Wood, and A. Hopper. Virtual network computing. IEEE Internet Computing, 2(1):33–38, 1998.
39. J. Ruderman. The Same Origin Policy. http://www.mozilla.org/projects/security/components/ same-origin.html.
40. R. W. Scheifler and J. Gettys. The X window system. ACM Transactions on Graphics (TOG), 5(2):79–109, April 1986.
41. J. S. Shapiro, J. Vanderburgh, E. Northup, and D. Chizmadia. Design of the EROS TrustedWindow system. In Usenix Security, 2004.
42. Symantec Global Internet Security Threat Report: Trends for July - December 07, April 2008.
43. H. J. Wang, X. Fan, J. Howell, and C. Jackson. Protection and Communication Abstractions in MashupOS. In ACM Symposium on Operating System Principles, October 2007.
44. Cross-Domain Vulnerability In Microsoft Internet Explorer 6. http://cyberinsecure.com/ cross- domain- vulnerability- in- microsoft-internet- explorer- 6/.
45. The XMLHttpRequest Object. http://www.w3.org/TR/XMLHttpRequest/.
46. W3C XMLHttpRequest Level 2. http://dev.w3.org/2006/webapi/XMLHttpRequest-2/.
47. B. Yee, D. Sehr, G. Dardyk, B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar. Native client: A sandbox for portable, untrusted x86 native code. In Proceedings of the IEEE Symposium on Security and Privacy, May 2009.
48. M. Zalewski. Browser security handbook, 2008. http://code.google.com/p/browsersec/wiki/Main.