Securing Frame Communication in Browsers Adam Barth Collin Jackson John C. Mitchell Stanford University Stanford University Stanford University [email protected] [email protected] [email protected] Abstract isolate frames. In more complex mashups, the integra- tor does intend to communicate with the gadgets and re- Many web sites embed third-party content in frames, re- quires secure inter-frame communication. lying on the browser’s security policy to protect them In this paper, we study the contemporary web ver- from malicious content. Frames, however, are often in- sion of a recurring problem in computer systems: isolat- sufficient isolation primitives because most browsers let ing untrusted, or partially trusted, software components framed content manipulate other frames through naviga- while providing secure inter-component communication. tion. We evaluate existing frame navigation policies and Whenever a site integrates third-party content, such as advocate a stricter policy, which we deploy in the open- an advertisement, a map, or a photo album, the site runs source browsers. In addition to preventing undesirable the risk of incorporating malicious content. Without iso- interactions, the browser’s strict isolation policy also hin- lation, malicious content can compromise the confiden- ders communication between cooperating frames. We tiality and integrity of the user’s session with the inte- analyze two techniques for inter-frame communication. grator. While the browser’s well-known “same-origin The first method, fragment identifier messaging, pro- policy” [34] restricts script running in one frame from vides confidentiality without authentication, which we manipulating content in another frame, the browser uses repair using concepts from a well-known network pro- a different policy to determine whether one frame is al- tocol. The second method, postMessage, provides lowed to navigate (change the location of) another frame. authentication, but we discover an attack that breaches Although restricting navigation is essential to providing confidentiality. We modify the postMessage API to isolation, navigation also enables one form of inter-frame provide confidentiality and see our modifications stan- communication used in mashup frameworks from lead- dardized and adopted in browser implementations. ing companies. Furthermore, we show that an attacker can use frame navigation to attack another inter-frame 1 Introduction communication mechanism, postMessage. Web sites contain content from sources of varying trust- Isolation. We examine the browser frame as an iso- worthiness. For example, many web sites contain third- lation primitive. Because frames can contain untrusted party advertising supplied by advertisement networks or content, the browser’s security policy restricts frame in- their sub-syndicates [6]. Other common aggregations teractions. Many browsers, however, insufficiently re- of third-party content include Flickr albums [12], Face- strict the ability of one frame to navigate another frame book badges [9], and personalized home pages offered to a new location. These overly permissive frame nav- by the three major web portals [15, 40, 28]. More ad- igation policies lead to a variety of attacks, which we vanced uses of third-party components include Yelp’s demonstrate against the Google AdSense login page and use of Google Maps [14] to display restaurant locations the iGoogle gadget aggregator. To prevent these attacks, and the Windows Live Contacts gadget [27]. A web we propose tightening the browser’s frame navigation site combining content from multiple sources is called a policy while maintaining compatibility with existing web mashup, with the party combining the content called the content. We have collaborated with browser vendors to integrator and integrated content called a gadget. In sim- deploy this policy in Firefox 3 and Safari 3.1. As the ple mashups, the integrator does not intend to communi- policy is already implemented in Internet Explorer 7, the cate with the gadgets and requires only that the browser policy is now deployed in the three most-used browsers. USENIX Association 17th USENIX Security Symposium 17 Confidentiality Authentication Network Analogue Fragment identifier channel Public Key Encryption postMessage channel Public Key Signatures postMessage (our proposal) SSL/TLS Table 1: Security properties of frame communication channels Communication. With strong isolation, frames are Organization. The remainder of the paper is organized limited in their interactions, raising the issue of how iso- as follows. Section 2 details the threat model for these at- lated frames can cooperate as part of a mashup. We tacks. Section 3 surveys existing frame navigation poli- analyze two techniques for inter-frame communication: cies and converges browsers on a secure policy. Sec- fragment identifier messaging and postMessage. The tion 4 analyzes two frame communication mechanisms, results of our analysis are summarized in Table 1. demonstrates attacks, and proposes defenses. Section 5 describes related work. Section 6 concludes. Fragment identifier messaging uses characteristics • of frame navigation to send messages between frames. As it was not designed for communica- 2 Threat Model tion, the channel has less-than-desirable security In this paper, we are concerned with securing in-browser properties: messages are confidential but senders interactions from malicious attackers. We assume an are not authenticated. To understand these prop- honest user employs a standard web browser to view con- erties, we draw an analogy between this commu- tent from an honest web site. A malicious “web attacker” nication channel and a network channel in which attempts to disrupt this interaction or steal sensitive infor- senders encrypt their messages to their recipi- mation. Typically, a web attacker places malicious con- ent’s public key. For concreteness, we examine tent (e.g., JavaScript) in the user’s browser and modifies Microsoft.Live.Channels the library [27], the state of the browser, interfering with the honest ses- which uses fragment identifier messaging to let sion. To study the browser’s security policy, which deter- the Windows Live Contacts gadget communicate mines the privileges of the attacker’s content, we define with its integrator. The protocol used by Win- the web attacker threat model below. dows Live is analogous to the Needham-Schroeder public-key protocol [29]. We discover an attack on this protocol, related to Lowe’s anomaly in the Web Attacker. A web attacker is a malicious princi- Needham-Schroeder protocol [23], in which a mali- pal who owns one or more machines on the network. In cious gadget can impersonate the integrator to the order to study the security of browsers when rendering Contacts gadget. We suggested a solution based malicious content, we assume that the browser gets and on Lowe’s improvement to the Needham-Schroeder renders content from the attacker’s web site. protocol [23], and Microsoft implemented and de- Network Abilities. The web attacker has no spe- • ployed our suggestion within days. cial network abilities. In particular, the web attacker can send and receive network messages only from postMessage is a new browser API designed for • machines under his or her control, possibly acting inter-frame communication [19]. postMessage as a client or server in network protocols of the at- is implemented in Opera, Internet Explorer 8, Fire- tacker’s choice. Typically, the web attacker uses at fox 3, and Safari. Although postMessage has least one machine as an HTTP server, which we been deployed since 2005, we demonstrate an attack refer to for simplicity as attacker.com. The on the channel’s confidentiality using frame navi- web attacker can obtain SSL certificates for do- gation. In light of this attack, the postMessage mains he or she owns; certificate authorities such channel provides authentication but lacks confiden- as instantssl.com provide such certificates for tiality, analogous to a channel in which senders free. The web attacker’s network abilities are decid- cryptographically sign their messages. To se- edly weaker than the usual network attacker consid- cure the channel, we propose a change to the ered in studies of network security because the web postMessage API. We implemented our change attacker can neither eavesdrop on messages sent to in patches for Safari and Firefox. Our proposal has other recipients nor forge messages from other net- been adopted by the HTML 5 working group, Inter- work locations. For example, a web attacker cannot net Explorer 8, Firefox 3, and Safari. act as a “man-in-the-middle.” 1 17th USENIX Security Symposium USENIX Association Interaction with Client. We assume the honest Out-of-Scope Threats. Although phishing [11, 7] can • user views attacker.com in at least one browser be described informally as a “web attack,” the web window, thereby rendering the attacker’s content. attacker defined above does not attempt to fool the We make this assumption because we believe that user by choosing a confusing domain name (such as an honest user’s interaction with an honest site bankofthevvest.com) or using other social engi- should be secure even if the user separately vis- neering. In particular, we do not assume that a user its a malicious site in a different browser window. treats attacker.com as if it were a site other than We assume the web attacker is constrained by the attacker.com. The attacks presented in this paper browser’s security policy and does not employ a are “pixel-perfect” in the sense that the browser provides browser exploit to circumvent the policy. The web the user no indication whatsoever that an attack is under- attacker’s host privileges are decidedly weaker than way. The attacks do not display deceptive images over an attacker who can execute a arbitrary code on the the browser security indicators nor do they spoof the lo- user’s machine with the user’s privileges. For exam- cation bar and or the lock icon. In this paper, we do not ple, a web attacker cannot install or run a system- consider cross-site scripting attacks, in which an attacker wide key logger or botnet client.