Verified security for browser extensions

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2011, Pages 115-130

  Guha, Arjun ^a   Fredrikson, Matthew ^b   Livshits, Benjamin ^c   Swamy, Nikhil ^c  

^a BROWN UNIVERSITY   (United States)

^b UNIVERSITY OF WISCONSIN MADISON   (United States)

^c MICROSOFT RESEARCH   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS CONTROL; COMPLIANCE CONTROL; DIGITAL STORAGE; SEMANTICS; SENSITIVE DATA; WEB BROWSERS;

BLOCKINGS; CROSS-DOMAIN; EMPIRICAL SURVEYS; EXTENSION CAPABILITIES; FORM FILLING; HIGHER-LEVEL LANGUAGES; NETWORK ACCESS; SECURE BROWSERS; SECURITY RISKS; THIRD PARTIES;

HIGH LEVEL LANGUAGES;

EID: 80052015113     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2011.36     Document Type: Conference Paper

References (36)

1. T. Ball and S. K. Rajamani. The SLAM project: Debugging system software via static analysis. In ACM POPL, 2002.
2. S. Bandhakavi, S. T. King, P. Madhusudan, and M. Winslett. VEX: Vetting browser extensions for security vulnerabilities. In USENIX Security, 2010.
3. A. Barth, A. P. Felt, and P. Saxena. Protecting browsers from extension vulnerabilities. In NDSS, 2010.
4. CA Technologies. Virus details: Win32/clspring family. http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?ID=42280, 2006.
5. J. Chen, R. Chugh, and N. Swamy. Type-preserving compilation of end-to-end verification of security enforcement. In ACM PLDI, 2010.
6. R. Chugh, J. A. Meister, R. Jhala, and S. Lerner. Staged information flow for JavaScript. In ACM PLDI, 2009.
7. L. de Moura and N. Bjorner. Z3: An efficient SMT solver. In TACAS, 2008.
8. M. Dhawan and V Ganapathy. Analyzing information flow in JavaScript-based browser extensions. In ACSAC, 2009.
9. M. Egele, C. Kruegel, E. Kirda, H. Yin, and D. Song. Dynamic spyware analysis. In USENIX Security, 2007.
10. A. P. Felt, K. Greenwood, and D. Wagner. The effectiveness of install-time permission systems for third-party applications. Technical report, University of California at Berkeley, 2010. UCB/EECS-2010-143.
11. M. Fredrikson and B. Livshits. RePriv: Re-envisioning in- browser privacy. In IEEE S&P, 2011.
12. I. Goldberg, D. Wagner, R. Thomas, and E. A. Brewer. A secure environment for untrusted helper applications. In USENIX Security, 1996.
13. Google Chrome. Popular Google Chrome extensions. http://chrome.google. com/extensions/list/popular, 2010.
14. A. D. Gordon and A. Jeffrey. Authenticity by typing for security protocols. Journal of Computer Security, 11, July 2003.
15. C. Grier, S. Tang, and S. T. King. Secure web browsing with the OP web browser. In IEEE S&P, 2008.
16. O. Grumberg and D. E. Long. Model checking and modular verification. ACM TOPLAS, 16, 1994.
17. S. Guarnieri and B. Livshits. GateKeeper: Mostly static enforcement of security and reliability policies for JavaScript code. In USENIX Security, 2009.
18. S. Guarnieri and B. Livshits. Gulfstream: Incremental static analysis for streaming JavaScript applications. In USENIX Conference on Web Application Development, 2010.
19. A. Guha, C. Saftoiu, and S. Krishnamurthi. The essence of JavaScript. In ECOOP, 2010.
20. E. Kirda, C. Kruegel, G. Banks, G. Vigna, and R. A. Kemmerer. Behavior-based spyware detection. In USENIX Security, 2006.
21. L. Koved, M. Pistoia, and A. Kershenbaum. Access rights analysis for Java. In ACM OOPSLA, 2002.
22. B. Lerner and D. Grossman. Language support for extensible web browsers. In APLWACA, 2010.
23. B. Lerner, H. Venter, B. Burg, and W. Schulte. C3: An experimental extensible, reconfigurable platform for HTML-based applications, 2010. In submission.
24. L. Li, X. Wang, and J. Y. Choi. SpyShield: Preserving privacy from spy add-ons. In Conference on Recent Advances in Intrusion Detection, 2007.
25. M. T. Louw, J. S. Lim, and V N. Venkatakrishnan. Enhancing web browser security against malware extensions. Journal of Computer Virology, 4(3), 2008.
26. L. Meyerovich and B. Livshits. ConScript: Specifying and enforcing fine-grained security policies for Javascript in the browser. In oakland, 2010.
27. Mozilla Foundation. How many Firefox users use addons? http://blog.mozilla.com/addons/2009/08/11/how-many-firefox-users-use-add-ons/, 2009.
28. Mozilla Foundation. Add-on security vulnerability announcement. http://blog.mozilla.com/addons/2010/07/13/add-on-security-announcement/, 2010.
29. N. Swamy, M. Hicks, and G. Bierman. A theory of typed coercions and its applications. In ACM ICFP, 2009.
30. N. Swamy, J. Chen, and R. Chugh. Enforcing stateful authorization and information flow policies in Fine. In ESOP, 2010.
31. N. Swamy, J. Chen, C. Fournet, K. Bhargavan, and J. Yang. Security programming with refinement types and mobile proofs. Technical report, MSR, 2010. MSR-TR-2010-149.
32. K. Thomas. Chrome browser acts more like an OS, but security is unclear. http://www.pcworld.com/businesscenter/article/220756/chrome-browser-acts-more- like-an-os-but-security-is-unclear.html, 2011.
33. H. Wang, C. Grier, E. Moshcuk, S. T. King, P. Choudhury, and H. Venter. The multi-principal OS construction of the Gazelle web browser. In USENIX Security, 2009.
34. B. Yee, D. Sehr, G. Dardyk, J. B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar. Native client: A sandbox for portable, untrusted x86 native code. In IEEE S&P, 2009.
35. L. Zheng and A. C. Myers. Dynamic security labels and noninterference. In Workshop on Formal Aspects in Security and Trust, 2004.
36. F Zhou, J. Condit, Z. Anderson, I. Bagrak, R. Ennals, M. Harren, G. Necula, and E. Brewer. SafeDrive: Safe and recoverable extensions using language-based techniques. In USENIX OSDI, 2006.