Improving Security and Privacy of Integrated Web Applications A Dissertation Presented to the Faculty of the School of Engineering and Applied Science University of Virginia In Partial Fulfillment of the requirements for the Degree Doctor of Philosophy (Computer Engineering) by Yuchen Zhou May 2015 c 2015 Yuchen Zhou Abstract Modern applications integrate third-party services for easier development, additional functionality (e.g., connecting with social network identities), and extra revenue (e.g., advertising networks). This integra- tion, however, presents risks to application integrity and user privacy. This research addresses integrated applications that incorporate two types of third-party services: (1) services from trusted providers that provide security-critical functionalities to an application such as Single Sign-On (SSO), and (2) services from untrusted providers that incorporate other services such as analytics and advertisements. Unlike traditional library inclusions, integrated applications present new challenges due to the opaqueness of third-party back end services and platform runtimes. For the first type of integration, we assume a benign service provider and our goal is to eliminate misunderstandings between the service provider and the application developer that may lead to security vulnerabilities in the implementation. We advocate for a systematic approach to discover implicit assumptions that uses an iterative process to refine system models and uncover needed assumptions. To better understand the prevalence of discovered vulnerabilities at large scale, we developed an automated vulnerability scanner, SSOScan, that can be deployed in an application marketplace or as a stand-alone service. This testing framework can drive the application automatically and check if a given application is vulnerable by carrying out simulated attacks and monitoring application traffic and behavior, and we have used it to automatically find serious vulnerabilities in hundreds of websites. For the second type of integration, the embedding application does not rely on a third-party service for security-critical functionality, but wants to prevent harm to the application and its users from embedded services that may be malicious. Integrated services often execute as the same principal as the host application code, with full access to application and user data. To mitigate the potential risks of integrating untrusted code, our approach aims to prevent third-party services from exfiltrating sensitive data or maliciously tampering i Abstract ii with the host content. To this end, we first developed a modified Chromium browser that supports fine-grained DOM access control, as well as JavaScript execution context isolation. We built an automatic policy generator that identifies private information by comparing duplicate requests. To reduce false positives and further improve site administrator’s understanding of third-party JavaScript behavior, we built ScriptInspector, a modification of Firefox that mediates, records, and visualizes critical resource accesses. ScriptInspector can be used to compare runtime accesses with existing policies and report violations to site administrators. To facilitate policy creation, the PolicyGenerator extension proposes permission candidates for site administrators to inspect, edit, and approve. The nature of modern web application development presents major challenges for security. Although developers are prone to make mistakes when integrating third-party components, the systematic analysis approach, automatic scanners, and developer tools we present can significantly increase a developer’s confidence in the security and privacy of integrated applications. APPROVAL SHEET The dissertation is submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy AUTHOR The dissertation has been read and approved by the examining committee: David Evans Advisor Shuo Chen Joanne Dugan Kevin Sullivan Westley Weimer Ronald Williams Accepted for the School of Engineering and Applied Science: Dean, School of Engineering and Applied Science May 2015 此博士论文 献给我敬爱的父母，感谢你们一直以来对我的信任与爱； 献给我已故的奶奶，感谢您对我十多年来无微不至的关怀与照料； 献给我的妻子，感谢你在攻读博士期间给我的理解与支持； This dissertation is also dedicated to my PhD advisor Dr. David Evans and internship mentor Dr. Shuo Chen, who offered their unwavering support and encouragement over the years. iv Acknowledgements Over the past six years of my PhD studies, I have received support from a great number of individuals, both emotionally and professionally. First and most importantly, I would like to express my sincere thanks to my PhD advisor Dr. David Evans. Dr. Evans has been a great mentor, colleague, and friend. His guidance has made this a thoughtful and rewarding journey, and his firm support for me to travel to numerous conferences and talk with various researchers gave me a vantage point for the entire research area. Second, I would like to thank Dr. Shuo Chen and Dr. Rui Wang specifically, my Microsoft Research mentors, who opened my eyes to a new different world; the work we did together eventually became a big part of this dissertation. Third, I want to thank the rest of my PhD committee members: Dr. Joanne Dugan, Dr. Kevin Sullivan, Dr. Westley Weimer, and Dr. Ronald Williams for their comments and suggestions to perfect this dissertation. I also had the great honor to work with an excellent group of fellow graduate and undergraduate students in the security research group here at the University of Virginia. I appreciate the inspiration from all of you — Jeffrey Shirley, Yan Huang, Yu Yao, Peter Chapman, Jonathan Burket, Tianhao Tong, Samee Zahur, Yikan Chen, Longze Chen, Ivan Alagenchev, Simon Sibomana, Weilin Xu, Haina Li, and Natnatee Dokmai. I also need to thank my fellow computer engineering PhD students Runjie Zhang, Michael Boyer, Jiawei Huang, and Shuai Che for their help and suggestions over the years. I would also like to thank my other colleagues at Microsoft Research, Shaz Qadeer and Yuri Gurevich, who provided us with support and help on model checking and theorem proving techniques. Finally, I would not be able to achieve all these without the generous funding support from the National Science Foundation, the Air Force Office of Scientific Research, and Google. I would like to thank them for their financial support throughout my PhD studies. v Contents Contents vi List of Tables............................................. ix List of Figures.............................................x 1 Introduction 1 1.1 Risks of Integrated Applications................................1 1.1.1 Integrating security services..............................2 1.1.2 Embedding untrusted services.............................3 1.2 Thesis..............................................4 1.3 Dissertation Contributions...................................4 2 Background 7 2.1 Privileges of Third-Party Scripts................................8 3 The Explication Process 10 3.1 Single Sign-On Service..................................... 11 3.1.1 Integration approach.................................. 12 3.1.2 The SSO protocols................................... 13 3.1.3 Facebook OAuth 2.0 workflow............................. 14 3.1.4 Facebook Connect credential types.......................... 14 3.2 Prior Work............................................ 15 3.2.1 API and SDK Misuses................................. 16 3.2.2 Program and Interface Verification........................... 16 3.2.3 Protocol Analysis.................................... 17 3.3 An Illustrative Example..................................... 18 3.3.1 Intended Use...................................... 18 3.3.2 Unintended (Hazardous) Use.............................. 19 3.3.3 Resolution and Insights................................. 20 3.4 The Explication Process.................................... 21 3.4.1 Scenario......................................... 21 3.4.2 Threat Model...................................... 22 3.4.3 Security Properties................................... 23 3.4.4 The Iterative Explication Process........................... 23 3.5 Semantic Modeling....................................... 24 3.5.1 Modeling language................................... 24 3.5.2 Modeling Concrete Modules.............................. 25 3.5.3 Modeling Abstract Modules.............................. 29 vi Contents vii 3.5.4 Constructing Assertions................................ 30 3.6 Summary of explication discoveries.............................. 31 3.6.1 Assumptions Uncovered................................ 31 3.7 Exploit opportunities...................................... 33 3.7.1 Facebook SDK..................................... 33 3.7.2 Microsoft Live Connect................................ 37 3.7.3 Windows 8 Modern app SDK............................. 37 3.7.4 Testing Real-world Applications............................ 38 4 SSOScan: Automatic Vulnerability Scanner 41 4.1 A Manual Scanning Example.................................. 42 4.2 Related Work.......................................... 45 4.3 Targeted Vulnerabilities..................................... 47 4.4 Design and Implementation................................... 48 4.4.1 SSO Button Finder................................... 49 4.4.2 Completing Registration................................ 50 4.4.3 Oracle.......................................... 50 4.4.4 Vulnerability Tester................................... 51 4.5 Large-scale Study.......................................