Exposing Security and Privacy Liabilities in Modern Browsers
Total Page：16
File Type：pdf, Size：1020Kb
Exposing security and privacy liabilities in modern browsers Nikolaos Tsalis March 2017 Exposing security and privacy liabilities in modern browsers Nikolaos Tsalis A dissertation submitted for the partial fulfillment of a Ph.D. degree March 2017 ii Supervising Committee: 1. Dimitris Gritzalis, Professor, Athens University of Economics & Business (Chair) 2. Theodoros Apostolopoulos, Professor, Athens University of Economics & Business 3. Ioannis Marias, Assistant Professor, Athens University of Economics & Business Examination Committee: 1. Dimitris Gritzalis, Professor, Athens University of Economics & Business 2. Theodoros Apostolopoulos, Professor, Athens University of Economics & Business 3. Ioannis Marias, Associate Professor, Athens University of Economics & Business 4. Vasileios Katos, Professor, Bournemouth University, United Kingdom 5. Ioannis Stamatiou, Associate Professor, University of Patra 6. Panos Kotzanikolaou, Assistant Professor, University of Piraeus 7. Alexios Mylonas, Lecturer, Bournemouth University, United Kingdom iii Exposing security and privacy liabilities in modern browsers Copyright © 2017 by Nikolaos Tsalis Department of Informatics Athens University of Economics and Business 76 Patission Ave., Athens GR-10434, Greece All rights reserved. No part of this manuscript may be reproduced or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the author. iv "Η έγκριση διδακτορικής διατριβής υπό του Τμήματος Πληροφορικής του Οικονομικού Πανεπιστημίου Αθηνών δεν υποδηλοί αποδοχή των γνωμών του συγγραφέως.” (Ν. 5343/ 1932, άρθρο. 202) v Acknowledgements First and foremost, I would like to thank my Ph.D. supervisor Prof. Dimitris Gritzalis. We met back in 2008, while I was on my second year of undergraduate studies. I had selected Information Systems Security as an optional module without too much thought, as I was certain from the beginning that this was the field I would like to excel and purchase a career in. Mr. Gritzalis, as my academic shepherd, I thank you for your support and inspiration during my studies, but most importantly your patience and guidance throughout my life. I would also like to thank Prof. Theodoros Apostolopoulos and Associate Prof. Ioannis Marias for their support and inspiration during my undergraduate studies and Prof. Jason Crampton (Royal Holloway) who guided me in my preliminary steps in research by supervising my MSc thesis. Secondly, I would like to thank Prof. Alexios Mylonas for his guidance during my academic path, as well as along my personal life, where he stood better than I hoped for. I am grateful that I shared my research journey with Prof. Vasileios Katos and Dr. Nikos Virvilis. Also, I would like to thank Dr. Vasilis Tsoumas, Dr. Stelios Dritsas, Dr. Marianthi Theocharidou and Dr. Giannis Soupionis. They were the ones that helped me the most on my first research steps, either by co-authoring, reviewing or tutoring. I am grateful for their support and professionalism but mainly for their friendship. I also want to thank Dr. George Stergiopoulos, Miltiadis Kandias and Vasilis Stavrou for their support, cooperation, and their friendship, which guided us all through time. Furthermore, I am thankful to Prof. Panos Constantopoulos and Prof. Theodoros Apostolopoulos for offering me a position as a systems and network administrator during my academic research. I am also thankful to Dr. Theorodos Ntouskas, Antonia Nisioti, Despoina Metzelioti, Georgia Lykou and George Iakovakis for their friendship and support during these years. Finally, I would like to thank all the people that stood right besides me all my life; my parents for their endless love and support, my family for their guidance and Elena Hadjiyiangou for her support and patience all these years. Time will always heal the mind, but the heart will never forget. vi Dedication To those who take care of us, even from far away. To the people I loved and cared for. We will all be together in the end. vii Abstract The number and complexity of the available online threats have been increasing steadily in recent years. One of the primary goals of the attackers is financial gains against the users, who can barely protect themselves against such threats. This matter is further empowered by the weakened security environment that users operate in. More specifically, the average user is not technologically savvy, especially when it comes to the security aspect of the technology she uses, while she is not familiar with the available security countermeasures along with their usage. Similarly, the manufacturers must supposingly take care of an untrained user by providing an adequate level of security and privacy certainty, when the user is performing her online browsing activities, via the use of a simple browser. In contrast, it is proven to be more than challenging to achieve the golden ratio between usability and security, while the scale usually leans on the former. The online threat landscape is continuously expanding due to the sophisticated types of theats and vulnerabilities that exist within a browser environment. For instance, modern browsers adopt additional features and services, with a view on funtionality, and thus further attack entry points are created that could surely aim in user’s security and privacy. By analyzing the security perspective of modern browser, one can easily result in the priorities that are set by the manufacturers, which are translated into significant threats that are currently available. To be more specific, phishing attacks are considered to be one of the most perilous threats, where the user is deceived into discolusing sensitive personal information. Similarly, the malware threat is equally important since, due to its complexity, it is more difficult to deal with. Privacy threats are also available which aim in the aforementioned information disclosure. Browser manufacturers are aware of the formerly mentioned threat landscape and have implemented several controls within modern browsers. Such controls are utilized as either built- in controls to the browser itself, or additional services (i.e. add-ons) that enhance or substitute the build-in ones. In addition, users rely on manufacturers for their protection and are not aware of how to operate the existing controls or implement additional ones for enhanced security. In order to protect the average user’s security and privacy in the online environment, it is vital to evaluate the existing defences and redisign the technologies that appear to be less effectictive as expected. The purpose of this thesis is to offer a comprehensive view of the online threat problem through analyzing the currently offered countermeasures along with their features, attack paths and techniques that are utilized. Such an approach will provide a clear view of whether the manufacturers do provide an adequate level of security from a quantitative perspective. In addition, the qualitative evaluation of some of the aforementioned controls are a focal point of viii this thesis. More specifically, those anti-threat mechanisms are put to the test via our assessment methodology and, in some cases, further enhancements or alternative sollutions are proposed and evaluated, in comparison to their predecessors. ix (this page is intentionally left blank) x Extended abstract (in Greek) Ο αριθμός και η πολυπλοκότητα των απειλών στο διαδίκτυο, έχουν αυξηθεί σταθερά τα τελευταία χρόνια. Ο βασικός στόχος των επιτιθέμενων είναι τα οικονομικά κέρδη έναντι των χρηστών, οι οποίοι δύσκολα μπορούν να προστατευθούν από τέτοιου είδους επιθέσεις. Το γεγονός αυτό ενισχύεται περαιτέρω από το αποδυναμωμένο περιβάλλον ασφαλείας μέσα στο οποίο λειτουργούν χρήστες καθημερινα. Πιο συγκεκριμένα, ο μέσος χρήστης δεν είναι επαρκώς ενημερωμένος σε θέματα τεχνολογίας, ειδικά σχετικά με θέματα ασφάλειας, ενώ παράλληλα, δεν γνωρίζει ποια είναι τα υπάρχοντα αντίμετρα ή πώς να τα χρησιμοποιεί. Ομοίως, οι κατασκευαστές των browers, είναι υποχρεωμένοι να προστατεύσουν τον ανεκπαίδευτο μέσο χρήστη και να του παράξουν ένα ανεκτό επίπεδο ασφάλειας όταν επισκέπτεται το διαδίκτυο. Όμως, έχει αποδειχθεί πως είναι αρκετά δύσκολο να βρεθεί η χρυσή τομή ανάμεσα στην χρηστικότητα και την ασφάλεια, ενώ συνήθως, το τελικό αποτέλεσμα της υλοποίησης των κατασκευαστών τείνει προς όφελος της πρώτης. Παράλληλα, οι υπάρχοντες απειλές και επιθέσεις, έχουν γίνει περισσότερες σε πλήθος και πιο πολύπλοκες. Για παράδειγμα, οι νέοι browsers περιέχουν επιπρόσθετα στοιχεία και υπηρεσίες (π.χ. JavaScript, Flash) με σκοπό την αυξημένη λειτουργικότητα, το οποίο έχει ως αποτέλεσμα την αύξηση των ευπαθειών και απειλών σχετικά με την ασφάλεια και την ιδιωτικότητα του χρήστη, δεδομένου ότι τα κενά ασφάλειας των υπηρεσιών αυτών κληρονομούνται στους browsers. Μέσω της ανάλυσης της ασφάλειας ενός σύγχρονου browser, είναι εμφανείς οι προτεραιότητες που έχουν τεθεί από τους κατασκευαστές, ως προς την προτεραιοποίηση των απειλών που υπάρχουν. Πιο συγκεκριμένα, οι απειλές τύπου phishing, έχουν χαρακτηριστεί ιδιαίτερα σημαντικές καθώς στοχεύουν στην απόκτηση προσωπικών δεδομένων του χρήστη. Το ίδιο ισχύει και για τις απειλές τύπου malware, οι οποίες είναι εξίσου σημαντικές, ιδιαιτέρως εξαιτίας της πολυπλοκότητάς τους, καθώς επίσης και οι τύποι των απειλών που στοχεύουν στην πλήξη της ιδιωτικότητας του χρήστη. Οι κατασκευαστές των browsers έχουν υλοποιήσει συγκεκριμένα αντίμετρα για να προστατεύσουν τον χρήστη ενάντια στις προαναφερθέντες απειλές. Τα