Securing script-based extensibility in web browsers

Proceedings of the 19th USENIX Security Symposium

Volumn , Issue , 2010, Pages 355-370

  Djeric, Vladan ^a   Goel, Ashvin ^a  

^a UNIVERSITY OF TORONTO   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (SYMBOLS); NETWORK SECURITY; WEBSITES;

CHARACTERISTIC SIGNATURE; CODE INJECTION; EXECUTION CONTROL; FALSE ALARMS; FIREFOX; FIREFOX WEB BROWSER;

WEB BROWSERS;

EID: 85076324236     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (23)

1. Adblock. http://en.wikipedia.org/wiki/Adblock.
2. Alexa the web information company. http://www.alexa.com.
3. Dromaeo JavaScript performance test suite. https://wiki.mozilla.org/Dromaeo.
4. Greasemonkey. http://en.wikipedia.org/wiki/Greasemonkey.
5. Return-to-libc attack. http://en.wikipedia.org/wiki/ Return-to-libc_attack.
6. setTimeout loses XPCNativeWrappers, July 2009. http://www.mozilla.org/security/announce/2009/mfsa2009-39.html.
7. Incorrect execution of JavaScript in the extension context, May 2010. http://googlechromereleases.blogspot.com/2010/05/ stable-channel-update.html.
8. XPConnect wrappers, May 2010. https://developer.mozilla.org/en/ XPConnect_wrappers.
9. D. Balzarotti, M. Cova, V. Felmetsger, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. Saner: Composing static and dynamic analysis to validate sanitization in web applications. In Proceedings of the IEEE Symposium on Security and Privacy, pages 387–401, 2008.
10. A. Barth, A. P. Felt, P. Saxena, and A. Boodman. Protecting browsers from extension vulnerabilities. In Proceedings of the Network and Distributed System Security Symposium, 2010.
11. A. Barth, J. Weinberger, and D. Song. Cross-origin JavaScript capability leaks: Detection, exploitation, and defense. In Proceedings of the USENIX Security Symposium, Aug. 2009.
12. S. Chen, D. Ross, and Y.-M. Wang. An analysis of browser domain-isolation bugs and a light-weight transparent defense mechanism. In Proceedings of the ACM Conference on Computer and Communications Security, pages 2–11, 2007.
13. M. Dhawan and V. Ganapathy. Analyzing information flow in Javascript-based browser extensions. In Proceedings of the Annual Computer Security Applications Conference, 2010.
14. J. R. Douceur, J. Elson, J. Howell, and J. R. Lorch. Leveraging legacy code to deploy desktop applications on the web. In Proceedings of the Operating Systems Design and Implementation (OSDI), pages 339–354, 2008.
15. M. T. Louw, J. S. Lim, and V. N. Venkatakrishnan. Enhancing web browser security against malware extensions. Journal in Computer Virology, 4(3):179–195, Aug. 2008.
16. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the Network and Distributed System Security Symposium, Feb. 2005.
17. C. Reis and S. D. Gribble. Isolating web programs in modern browser architectures. In Proceedings of the EuroSys conference, 2009.
18. A. Slowinska and H. Bos. Pointless Tainting? Evaluating the Practicality of Pointer Tainting. In Proceedings of the EuroSys conference, Apr. 2009.
19. P. Vogt, F. Nentwich, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. Cross-site scripting prevention with dynamic data tainting and static analysis. In Proceedings of the Network and Distributed System Security Symposium, 2007.
20. D. S. Wallach, D. Balfanz, D. Dean, and E. W. Felten. Extensible security architectures for Java. In Proceedings of the Symposium on Operating Systems Principles (SOSP), pages 116–128, 1997.
21. H. J. Wang, X. Fan, J. Howell, and C. Jackson. Protection and communication abstractions for web browsers in MashupOS. In Proceedings of the Symposium on Operating Systems Principles (SOSP), pages 1–16, 2007.
22. H. J. Wang, C. Grier, A. Moshchuk, S. T. King, P. Choudhury, and H. Venter. The multi-principal OS construction of the Gazelle web browser. In Proceedings of the USENIX Security Symposium, 2009.
23. B. Yee, D. Sehr, G. Dardyk, J. B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar. Native client: A sandbox for portable, untrusted x86 native code. In Proceedings of the IEEE Symposium on Security and Privacy, pages 79–93, 2009.