An evaluation of the google chrome extension security architecture

Proceedings of the 21st USENIX Security Symposium

Volumn , Issue , 2012, Pages 97-111

  Carlini, Nicholas ^a   Felt, Adrienne Porter ^a   Wagner, David ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

HTTP; WEBSITES;

CHROME EXTENSIONS; IN BROWSERS; NETWORK ATTACK; NETWORK ATTACKERS; PRIVATE DATA; SECURITY ARCHITECTURE; SECURITY MECHANISM; WEB ATTACKS;

NETWORK SECURITY;

EID: 84949441754     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (33)

1. L. Adamski. Security severity ratings. https://wiki.mozilla.org/Security_ Severity_Ratings.
2. B. Adida, A. Barth, and C. Jackson. Rootkits for JavaScript Environments. In Web 2.0 Security and Privacy (W2SP), 2009.
3. S. Bandhakavi, S. T. King, P. Madhusudan, and M. Winslett. VEX: Vetting Browser Extensions For Security Vulnerabilities. In USENIX Security, 2010.
4. A. Barth, A. P. Felt, P. Saxena, and A. Boodman. Protecting Browsers from Extension Vulnerabilities. In Network and Distributed System Security Symposium (NDSS), 2010.
5. Adam Barth. More secure extensions, by default. http://blog.chromium.org/2012/02/more-secure-extensions-by-default.html, February 2012.
6. D. J. Bernstein. The qmail security guarantee. http://cr.yp.to/qmail/guarantee.html.
7. A. Bittau, P. Marchenko, M. Handley, and B. Karp. Wedge: splitting applications into reduced-privilege compartments. In USENIX Symposium on Networked Systems Design and Implementation, 2008.
8. B. Chess, Y. T. O’Neil, and J. West. JavaScript Hijacking. Technical report, Fortify, 2007.
9. J. Drake, P. Mehta, C. Miller, S. Moyer, R. Smith, and C. Valasek. Browser Security Comparison: A Quantitative Approach. Technical report, Accuvant Labs, 2011.
10. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android Permissions Demystified. In ACM Conference on Computer and Communication Security (CCS), 2011.
11. A. P. Felt, M. Finifter, J. Weinberger, and D. Wagner. Diesel: Applying Privilege Separation to Database Access. In ACM Symposium on Information, Computer and Communications Security (AsiaCCS), 2011.
12. A. P. Felt, K. Greenwood, and D. Wagner. The Effectiveness of Application Permissions. In USENIX Conference on Web Application Development (WebApps), 2011.
13. Google Chrome Extensions. Content Security Policy (CSP). http://code.google.com/chrome/extensions/trunk/ contentSecurityPolicy.html.
14. A. Guha, M. Fredrikson, B. Livshits, and N. Swamy. Verified security for browser extensions. In IEEE Symposium on Security and Privacy, 2011.
15. C. Jackson. Block chrome-extension:// pages from importing script over non-https connections. http://code.google.com/p/chromium/issues/detail?id=29112.
16. Rezwana Karim, Mohan Dhawan, Vinod Ganapathy, and Chung chiech Shan. An Analysis of the Mozilla Jetpack Extension Framework. In Proceedings of the 26th European Conference on Object-Oriented Programming (ECOOP), 2012.
17. A. Krishnamurthy, A. Mettler, and D. Wagner. Fine-grained privilege separation for web applications. In International Conference on World Wide Web (WWW), 2010.
18. M. Krohn, P. Efstathopoulos, C. Frey, F. Kaashoek, E. Kohler, D. Mazières, R. Morris, M. Osborne, S. VanDeBogart, and D. Ziegler. Make Least Privilege a Right (Not a Privilege). In Conference on Hot Topics in Operating Systems, 2005.
19. L. Liu, X. Zhang, G. Yan, and S. Chen. Chrome Extensions: Threat Analysis and Countermeasures. In Network and Distributed System Security Symposium (NDSS), 2012.
20. R. S. Liverani and N. Freeman. Abusing Firefox Extensions. Defcon17.
21. A. Mikhailovsky, K. V. Gavrilenko, and A. Vladimirov. The Frame of Deception: Wireless Man-in-the-Middle Attacks and Rogue Access Points Deployment. http://www.informit.com/articles/article.aspx?p=353735&seqNum=7, 2004.
22. D. Murray and S. Hand. Privilege separation made easy: trusting small libraries not big processes. In European Workshop on System Security (EUROSEC), 2008.
23. N. Provos, M. Friedl, and P. Honeyman. Preventing Privilege Escalation. In USENIX Security Symposium, 2003.
24. G. Richards, C.Hammer, B. Burg, and J. Vivek. The Eval that Men Do: A Large-scale Study of the Use of Eval in JavaScript Applications. In European Conference on Object-Oriented Programming, 2012.
25. J. Saltzer and M. D. Schroeder. The Protection of Information in Computer Systems. In IEEE 63, 1975.
26. R. Saltzman and A. Sharabani. Active Man in the Middle Attacks: A Security Advisory. Technical report, IBM, 2009.
27. StackOverflow. Why is using JavaScript eval function a bad idea? http://stackoverflow.com/questions/86513/why-is-using-javascript -eval-function-a-bad-idea.
28. B. Sterne and A. Barth. Content security policy. https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/ csp-specification.dev.html.
29. Brandon Sterne and Adam Barth. Content security policy 1.1. https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/ csp-specification.dev.html, May 2012.
30. S. Wagner, J. Jurgens, C. Koller, and P. Trischberger. Comparing Bug Finding Tools with Reviews and Tests. Lecture Notes in Computer Science, 2005.
31. J. Weinberger, A. Barth, and D. Song. Towards Client-side HTML Security Policies. In Workshop on Hot Topics on Security (HotSec), 2011.
32. S. Willison. Understanding the Greasemonkey vulnerability. http://simonwillison.net/2005/Jul/20/vulnerability/.
33. C. Wuest and E. Florio. Firefox and Malware: When Browsers Attack. Technical report, Symantec, 2009.