Cross-origin JavaScript capability leaks: Detection, exploitation, and defense

Proceedings of the 18th USENIX Security Symposium

Volumn , Issue , 2009, Pages 187-197

  Barth, Adam ^a   Weinberger, Joel ^a   Song, Dawn ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BENCHMARKING; ENGINES; HIGH LEVEL LANGUAGES; SEMANTICS;

INDUSTRY-STANDARD BENCHMARKS; JAVASCRIPT; OPEN SOURCES;

ACCESS CONTROL;

EID: 84910677088     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (25)

1. Adam Barth, Collin Jackson, and John C. Mitchell. Securing frame communication in browsers. In Proceedings of the 17th USENIX Security Symposium, 2008.
2. Shuo Chen, David Ross, and Yi-Min Wang. An analysis of browser domain-isolation bugs and a light-weight transparent defense mechanism. In CCS’07: Proceedings of the 14th ACM conference on Computer and communications security, pages 2–11, New York, NY, USA, 2007. ACM.
3. Douglas Crockford. ADsafe.
4. Douglas Crockford. ADsafe DOM API.
5. Facebook. Facebook Markup Language (FBML).
6. Chris Grier, Shuo Tang, and Samuel T. King. Secure web browsing with the OP web browser. In IEEE Symposium on Security and Privacy, 2008.
7. Jeremiah Grossman. Clickjacking: Web pages can see and hear you, October 2008.
8. Norm Hardy. The keykos architecture. Operating Systems Review, 1985.
9. Norm Hardy. The confused deputy: (or why capabilities might have been invented). SIGOPS Oper. Syst. Rev., 22(4):36–38, 1988.
10. Ian Hickson et al. HTML 5 Working Draft.
11. Collin Jackson and Helen J. Wang. Subspace: Secure cross-domain communication for web mashups. In Proceedings of the 16th International World Wide Web Conference. (WWW), 2007.
12. Peter-Paul Koch. Frame busting, 2004. http://www.quirksmode.org/js/framebust.html.
13. Butler Lampson. Protection and access control in operating systems. Operating Systems: Infotech State of the Art Report, 14:309–326, 1972.
14. Sergio Maffeis, John C. Mitchell, and Ankur Taly. An operational semantics for JavaScript. In Proceedings of the 6th Asian Programming Language Symposium (APLAS), December 2008.
15. Mark Miller. A theory of taming.
16. Mark Miller. Caja, 2007.
17. Mitre. CVE-2008-4058.
18. Mitre. CVE-2008-4059.
19. Mitre. CVE-2008-5512.
20. Mozilla. XPConnect wrappers. http://developer.mozilla.org/en/docs/XPConnect_wrappers.
21. Sape J. Mullender, Guido van Rossum, Andrew Tannenbaum, Robbert van Renesse, and Hans van Staveren. Amoeba: A distributed operating system for the 1990s. Computer, 23(5):44–53, 1990.
22. Prototype JavaScript framework. http://www.prototypejs.org/.
23. Jonathan S. Shapiro, Jonathan M. Smith, and David J. Farber. Eros: a fast capability system. In 17th ACM Symposium on Operating System Principles, New York, NY, USA, 1999. ACM.
24. Maciej Stachowiak. Introducing SquirrelFish Extreme, 2008.
25. Kris Zyp. CrossSafe.