An Investigation Into Possible Attacks on HTML5 Indexeddb and Their Prevention
Total Page:16
File Type:pdf, Size:1020Kb
Citation: Kimak, Stefan (2016) An Investigation into Possible Attacks on HTML5 IndexedDB and their Prevention. Doctoral thesis, Northumbria University. This version was downloaded from Northumbria Research Link: http://nrl.northumbria.ac.uk/30260/ Northumbria University has developed Northumbria Research Link (NRL) to enable users to access the University’s research output. Copyright © and moral rights for items on NRL are retained by the individual author(s) and/or other copyright owners. Single copies of full items can be reproduced, displayed or performed, and given to third parties in any format or medium for personal research or study, educational, or not-for-profit purposes without prior permission or charge, provided the authors, title and full bibliographic details are given, as well as a hyperlink and/or URL to the original metadata page. The content must not be changed in any way. Full items must not be sold commercially in any format or medium without formal permission of the copyright holder. The full policy is available online: http://nrl.northumbria.ac.uk/policies.html An Investigation into Possible Attacks on HTML5 IndexedDB and their Prevention S Kimak PhD 2016 An Investigation into Possible Attacks on HTML5 IndexedDB and their Prevention Stefan Kimak A thesis submitted in partial fulfilment of the requirements of the University of Northumbria at Newcastle for the degree of Doctor of Philosophy Research undertaken in the Faculty of Engineering and Environment February 2016 Abstract This thesis presents an analysis of, and enhanced security model for IndexedDB, the persistent HTML5 browser-based data store. In versions of HTML prior to HTML5, web sites used cookies to track user preferences locally. Cookies are however limited both in file size and number, and must also be added to every HTTP request, which increases web traffic unnecessarily. Web functionality has however increased significantly since cookies were introduced by Netscape in 1994. Consequently, web developers require additional capabilities to keep up with the evolution of the World Wide Web and growth in eCommerce. The response to this requirement was the IndexedDB API, which became an official W3C recommendation in January 2015. The IndexedDB API includes an Object Store, indices, and cursors and so gives HTML5 - compliant browsers a transactional database capability. Furthermore, once downloaded, IndexedDB data stores do not require network connectivity. This permits mobile web- based applications to work without a data connection. Such IndexedDB data stores will be used to store customer data, they will inevitably become targets for attackers. This thesis firstly argues that the design of IndexedDB makes it unavoidably insecure. That is, every implementation is vulnerable to attacks such as Cross Site Scripting, and even data that has been deleted from databases may be stolen using appropriate software tools. This is demonstrated experimentally on both mobile and desktop browsers. IndexedDB is however capable of high performance even when compared to servers running optimized local databases. This is demonstrated through the development of a formal performance model. The performance predictions for IndexedDB were tested experimentally, and the results showed high conformance over a range of usage scenarios. This implies that IndexedDB is potentially a useful HTML5 API if the security issues can be addressed. In the final component of this thesis, we propose and implement enhancements that correct the security weaknesses identified in IndexedDB. The enhancements use multi- factor authentication, and so are resistant to Cross Site Scripting attacks. This enhancement is then demonstrated experimentally, showing that HTML5 IndexedDB may be used securely both online and offline. This implies that secure, standards compliant browser- based applications with persistent local data stores may both feasible and efficient. Table of Contents ABSTRACT .............................................................................................................................................. I TABLE OF CONTENTS ........................................................................................................................ II LIST OF FIGURES ................................................................................................................................. V LIST OF TABLES .................................................................................................................................. VI LIST OF EQUATIONS ........................................................................................................................ VII GLOSSARY OF TERMS .................................................................................................................... VIII DECLARATION .................................................................................................................................... IX CHAPTER 1. INTRODUCTION .......................................................................................................... 1 1.1. BACKGROUND OF THE RESEARCH ................................................................................................. 1 1.2. MOTIVATION .............................................................................................................................. 10 1.3. OBJECTIVES ................................................................................................................................. 11 1.4. SCOPE OF RESEARCH AND TIMELINESS OF RESEARCH TOPIC ..................................................... 12 1.5. CONTRIBUTIONS AND IMPACT .................................................................................................... 12 1.6. ORGANISATION OF THE THESIS .................................................................................................. 12 1.7. SUMMARY ................................................................................................................................... 13 CHAPTER 2. LITERATURE REVIEW ............................................................................................ 15 2.1. INTRODUCTION ........................................................................................................................... 15 2.2. RELATED WORK .......................................................................................................................... 15 2.3. HTML5 FUNCTIONALITY ........................................................................................................... 17 2.4. SERVER-SIDE DATABASES ........................................................................................................... 20 2.5. CLIENT-SIDE WEB DATABASES .................................................................................................. 21 2.6. DIFFERENCE BETWEEN CLIENT AND SERVER-SIDE DATABASES ................................................ 26 2.7. DIFFERENCES BETWEEN SQL AND NOSQL DATABASES ............................................................ 26 2.8. INDEXEDDB ................................................................................................................................ 27 2.9. SECURITY ISSUES ........................................................................................................................ 31 2.10. ONLINE AND OFFLINE ATTACKS ............................................................................................... 34 2.11. CRYPTOGRAPHY ....................................................................................................................... 42 2.12. BIOMETRICS AND MULTIFACTOR AUTHENTICATION (MFA) .................................................. 46 2.13. WEB SOCKETS .......................................................................................................................... 47 2.14. CONCLUSION ............................................................................................................................. 48 II CHAPTER 3. A PERFORMANCE MODEL FOR CLIENT-SIDE DATABASES ........................... 50 3.1. MOTIVATION .............................................................................................................................. 51 3.2. QUEUING MODEL ......................................................................................................................... 52 3.3. DATABASE REPLICATION ........................................................................................................... 53 3.4. DATABASE FRAGMENTATION ..................................................................................................... 54 3.5. PERFORMANCE FACTORS ............................................................................................................ 54 3.6. STRUCTURE OF TESTED DATABASES .......................................................................................... 56 3.7. DEFINE THE PERFORMANCE MODEL BASED ON THE QUEUING MODEL ...................................... 57 3.8. EXPERIMENT VALIDATION ......................................................................................................... 61 3.9. EXPERIMENTAL EVALUATION OF MODEL ................................................................................... 62 3.10. CONCLUSION ............................................................................................................................. 67 CHAPTER 4. A SECURITY INVESTIGATION OF INDEXEDDB ................................................