Understanding and Mitigating Attacks Targeting Web Browsers

Understanding and Mitigating Attacks Targeting Web Browsers A Dissertation presented in partial fulfillment of the requirements for the degree of Doctor of Philosophy in the field of Information Assurance by Ahmet Salih Buyukkayhan Northeastern University Khoury College of Computer Sciences Boston, Massachusetts April 2019 To my family, teachers and mentors. i Contents List of Figures v List of Tables vii Acknowledgments viii Abstract of the Dissertation ix 1 Introduction 1 1.1 Structure of the Thesis . .2 2 Background 4 2.1 Browser Extensions . .4 2.1.1 Firefox Extensions . .5 2.1.2 Extension Security . .7 2.2 Vulnerabilities in Web Applications . .9 2.2.1 Vulnerability Reward Programs and Platforms . .9 2.2.2 XSS Vulnerabilities . 10 2.2.3 XSS Defenses . 12 3 CrossFire: Firefox Extension-Reuse Vulnerabilities 14 3.1 Overview . 14 3.2 Threat Model . 15 3.3 Design . 16 3.3.1 Vulnerability Analysis . 17 3.3.2 Exploit Generation . 19 3.3.3 Example Vulnerabilities . 20 3.4 Implementation . 23 3.5 Evaluation . 23 3.5.1 Vulnerabilities in Top Extensions . 23 3.5.2 Random Sample Study of Extensions . 25 3.5.3 Performance & Manual Effort . 27 ii 3.5.4 Case Study: Submitting an Extension to Mozilla Add-ons Repository . 28 3.5.5 Jetpack Extensions. 30 3.5.6 Implications on Extension Vetting Procedures . 31 3.6 Summary . 31 4 SENTINEL: Securing Legacy Firefox Extensions 33 4.1 Overview . 33 4.2 Threat Model . 34 4.3 Design . 35 4.3.1 Intercepting XPCOM Operations . 36 4.3.2 Intercepting XUL Document Manipulations . 37 4.3.3 Preventing Namespace Collision Exploits . 40 4.3.4 Policy Manager . 41 4.3.5 Limitations . 43 4.4 Implementation . 43 4.4.1 Proxy Objects . 43 4.4.2 XPCOM Objects as Method Arguments . 45 4.4.3 XUL Elements without an ID . 45 4.4.4 Modifications to the Browser and Extensions . 46 4.5 Evaluation . 48 4.5.1 Policy Examples . 48 4.5.2 Runtime Performance . 56 4.5.3 Applicability of the Solution . 57 4.5.4 Falsely Blocked Legitimate Extensions . 58 4.6 Summary . 59 5 An Empirical Analysis of XSS Exploitation Techniques 60 5.1 Overview . 60 5.2 Methodology . 63 5.2.1 Data Collection . 63 5.2.2 Feature Selection . 65 5.2.3 Exploit String Extraction . 66 5.2.4 Static Feature Extraction . 68 5.2.5 Exploit Execution . 69 5.2.6 Dynamic Feature Extraction . 71 5.2.7 Data Integration and Filtering . 72 5.2.8 Validation . 73 5.3 Analysis . 74 5.3.1 Affected Websites . 76 5.3.2 Sink Analysis . 77 5.3.3 XSS Filters . 79 5.3.4 Exploit Analysis . 81 iii 5.3.5 Exploit Patterns . 88 5.3.6 Exploit Sophistication . 90 5.3.7 Exploit Authors . 92 5.4 Summary . 95 6 Papers 96 6.1 Thesis Publications . 96 6.2 Other Publications . 96 7 Conclusion 99 Bibliography 101 iv List of Figures 3.1 An overview of the core components of CROSSFIRE................. 17 3.2 Breakdown of true positive vulnerabilities discovered by CROSSFIRE by category. 26 3.3 Screenshots from Mozilla Add-ons website showing the accepted extension and its fully reviewed status. 28 4.1 Overview of SENTINEL from the user’s perspective. 35 4.2 An overview of SENTINEL, demonstrating how a file deletion operation can be intercepted and checked with a policy. 37 4.3 Implementation of the Object Proxy using a proxy construct. 44 4.4 A malicious extension can redirect users visiting “https://www.bankofamerica.com” to a different website “http://example.com” and fake the browser identity indicators. 51 5.1 Overview of our static and dynamic analysis system. 64 5.2 Quarterly exploit submissions and unique affected domains in XSSED (outer) and OPENBUGBOUNTY (inset). Most new submissions are found on new domains, suggesting a large supply of vulnerable domains on the Web. 75 5.3 Quarterly distribution of the popularity of domains affected by exploit submissions (XSSED left, OPENBUGBOUNTY right). Domains grouped by popularity according to their Alexa ranks; the last interval includes unranked domains. More than half of submissions are for unpopular websites. The rank interval distribution is al- most uniform over time, illustrating that XSS vulnerabilities continue to be found even on the most popular websites. 76 5.4 Quarterly tag and event handler market share in OPENBUGBOUNTY. Submissions of script tags decline in favor of other tags with event handlers. 84 5.5 CDF of sophistication scores. XSSED submissions tend to have lower scores than OPENBUGBOUNTY, and less score diversity due to fewer patterns. 85 5.6 Quarterly median sophistication score for all submissions and for distinct exploit patterns in OPENBUGBOUNTY. Inset shows XSSED data. 85 v 5.7 Correlation matrix of exploitation techniques and selected tags and attributes for (a) XSSED and (b) OPENBUGBOUNTY. Use of <script> is negatively correlated with most other techniques, meaning they are used alternatively. The popular exploit pattern <img src=# onerror> is visible as the pairwise correlation between <img>, src, and F2. Rarely used techniques such as I1 and O3, or I2 and F4, may be correlated because most uses occur in similar submissions by the same author. 88 5.8 CDF of exploit sophistication according to author productivity. Low productivity users contribute fewer low score exploits, causing a higher median. 93 5.9 Difference between the lowest and highest scored exploit per user with 10+ submissions (CDF). Most users submit exploits of varying sophistication. 94 5.10 CDF of the median and max. sophistication score per author. The most productive users are aware of sophisticated techniques, but use them sparingly. 94 vi List of Tables 3.1 Examples of security-sensitive XPCOM and browser APIs used by CROSSFIRE as data-flow sinks during vulnerability analysis. 18 3.2 Detailed analysis results of the top 10 Firefox extensions. 24 3.3 Five-number summaries, mean, and total values of CROSSFIRE’s static analysis results. The experiment is performed on the top 2,000 Firefox extensions. 24 3.4 Summary of the true and false positives detected by CROSSFIRE when analyzing 323 extensions randomly sampled from top 2,000 Firefox extensions. 25 3.5 Five-number summaries and the mean time measurements of automatic static analysis by CROSSFIRE, and human analysis to craft working exploits from exploit templates. 27 4.1 Runtime overhead imposed by SENTINEL on Firefox when running popular extensions. 57 4.2 The percentage of Jetpack and legacy extensions among the top 1,000 popular Firefox extensions. 57 5.1 Raw XSS Data Collected (before filtering). 64 5.2 Examples for exploitation techniques excluded due to very low occurrence (func- tionally equivalent to alert(1))........................... 66 5.3 Exploits Executed by Triggering Events . 69 5.4 Validation of Static and Dynamic Feature Extraction . 73 5.5 Exploits blocked by XSS filters (HTTP GET only) . 80 5.6 Aggregated Use of Exploitation Techniques . 82 5.7 Detected Exploitation Techniques by Category. ( static, dynamic, combined detection methodology; percentages for XSSED G#/OPENBH#UGBOUNTY )...... 87 5.8 Most Common Exploit Patterns (ordered by submissions; rank for author use in second column) . 89 5.9 The Top 5 Exploits by Sophistication Score . 91 vii Acknowledgments This thesis is written with the support, mentorship, and encouragement given to me by many people. I would like to first thank my advisor Prof. Engin Kirda who helped me to discover my interests in security research during my undergrad years and then offered me the opportunity to pursue Ph.D. in cybersecurity at Northeastern. I am also thankful to Prof. William Robertson and Prof. Engin Kirda for their guidance, mentorship, and support in every stage of my Ph.D. I thank my committee members Prof. Gianluca Stringhini and Prof. Alina Oprea for patiently reading this thesis and providing valuable comments and feedbacks. I owe a special gratitude to Prof. Alina Oprea for advising me on the projects we.

Load more