Rootkits for JavaScript environments

3rd USENIX Workshop on Offensive Technologies, WOOT 2009

Volumn , Issue , 2009, Pages

  Adida, Ben ^a   Barth, Adam ^b   Jackson, Collin ^c  

^a HARVARD UNIVERSITY   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c STANFORD UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

HIGH LEVEL LANGUAGES; MALWARE; MANAGERS;

BOOKMARKLETS; CLOUD-BASED; JAVASCRIPT; PASSWORD MANAGERS;

AUTHENTICATION;

EID: 85084160402     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (17)

1. Google AdSense, https://www.google.com/adsense/.
2. Google Maps, http://maps.google.com/.
3. Microsoft, Windows Live contacts control (beta), http://dev.live.com/contactscontrol/.
4. S. Kangas, About bookmarklets, http://www.bookmarklets.com/about/.
5. M. Wu, R. C. Miller, and G. Little, Web Wallet: Preventing phishing attacks by revealing user intentions, in Proc. of the 2006 Symposium On Usable Privacy and Security (SOUPS’06).
6. K.-P. Yee and K. Sitaker, Passpet: Convenient password management and phishing protection, in Proc. of the 2006 Symposium On Usable Privacy and Security (SOUPS’06).
7. S. T. King, P. M. Chen, Y.-M. Wang, C. Verbowski, H. J. Wang, and J. R. Lorch, SubVirt: Implementing malware with virtual machines, in Proc. of the 2006 IEEE Symposium on Security and Privacy.
8. F. M. David, E. M. Chan, J. C. Carlyle, and R. H. Campbell, Cloaker: Hardware supported rootkit concealment, in Proc. of the 2008 IEEE Symposium on Security and Privacy.
9. D. Crockford et al., ECMAScript 3.1 goals, February 2008, http://wiki.ecmascript.org/doku.php?id=es3.1:es3.1_goals.
10. A. Barth, C. Jackson, and J. C. Mitchell, Securing frame communication in browsers, in In Proceedings of the 17th USENIX Security Symposium (USENIX Security 2008).
11. J. Ruderman, JavaScript Security: Same Origin, http://www.mozilla.org/projects/security/components/same-origin.html.
12. R. Sayre et al., Sites not loading—redeclaration const JSON error on console, https://bugzilla.mozilla.org/show_bug.cgi?id=459293.
13. S. Maffeis, J. C. Mitchell, and A. Taly, An operational semantics for JavaScript, in Proc. of the Sixth ASIAN Symposium on Programming Languages and Systems (APLAS 2008).
14. VeriSign Inc., Personal identity protector - using one-click sign-in, https://pip.verisignlabs.com/1click_ howtouse.do.
15. A. Barth, C. Jackson, and J. C. Mitchell, Robust defenses for cross-site request forgery, in To appear at the 15th ACM Conference on Computer and Communications Security (CCS 2008).
16. Passpack, Fixed: 1 click login button, October 2008, http://passpack.wordpress.com/2008/10/11/reinstall-1click-login-button/.
17. R. Fielding et al., Hypertext transfer protocol – http/1.1, http://www.ietf.org/rfc/rfc2616.txt.