Rootkits for JavaScript Environments Ben Adida Adam Barth Collin Jackson Harvard University UC Berkeley Stanford University ben [email protected] [email protected] [email protected] Abstract Web Site Bookmarklet Web Site Bookmarklet A number of commercial cloud-based password managers use bookmarklets to automatically populate and submit login forms. Unfortunately, an attacker web Native JavaScript environment site can maliciously alter the JavaScript environment and, when the login bookmarklet is invoked, steal the Figure 1. Developers assume the bookmarklet in- user’s passwords. We describe general attack tech- teracts with the native JavaScript environment directly niques for altering a bookmarklet’s JavaScript envi- (left). In fact, the bookmarklet’s environment can be ronment and apply them to extracting passwords from manipulated by the current web page (right). six commercial password managers. Our proposed solution has been adopted by several of the commercial vendors. If the user clicks a bookmarklet while visiting an untrusted web page, the bookmarklet’s JavaScript is run in the context of the malicious page, potentially 1. Introduction letting an attacker manipulate its execution by care- fully crafting its JavaScript environment, essentially One promising direction for building engaging web installing a “rootkit” in its own JavaScript environment experiences is to combine content and functionality (See Figure 1). Instead of interacting with the native from multiple sources, often called a “mashup.” In JavaScript objects, the bookmarklet interacts with the a traditional mashup, an integrator combines gadgets attacker’s objects. This attack vector is not much of (such as advertisements [1], maps [2], or contact a concern for Delicious’ social bookmarking service, lists [3]), but an increasingly popular mashup design because the site’s own interests are served by advertis- involves the user adding a bookmarklet [4] (also known ing its true location and title. However, these rootkits as a JavaScript bookmark or a favelet) to his or her are a serious concern for more advanced bookmarklets, bookmark bar. To activate the mashup, the user clicks where the malicious web site might benefit from sub- the bookmarklet and the browser runs the JavaScript verting the bookmarklet’s functionality. In particular, contained in the bookmarklet in the context of the cur- these rootkits are a problematic for login bookmarklets. rent web page. This type of mashup is opportunistic: By using bookmarklets, a server-based password the bookmarklet’s code runs within a web page it might manager can enable one-click sign-on at each of not have encountered previously. Bookmarklets were the user’s favorite sites, synchronization of passwords popularized by the social bookmarking site Delicious, across computers, and automatic generation of strong whose bookmarklet enables users to add the currently passwords, features that are not found in typical viewed site to their Delicious feed, URL and title in- browser-built-in password managers. To automatically cluded, with just one click. Bookmarklets offer advan- log the user into the current site, the login book- tages over browser plug-ins [5], [6]: they are easier to marklet must make a critical security decision about develop, easier to install, and work with every browser. which password to use. If the bookmarklet supplies the Many other web sites have published bookmarklets, wrong password, an attacker might be able to trick the including Google, Yahoo!, Microsoft Windows Live, bookmarklet into revealing the user’s online banking Facebook, Reddit, WordPress, and Ask.com. password. 1 A traditional rootkit [7], [8] modifies the user- same-origin policy that isolates web pages that the program-accessible behavior of the operating system browser retrieved from different origins [11]. In partic- and escapes detection by interception of the operat- ular, we assume the attacker owns an untrusted domain ing system’s reflection APIs, for example removing name, e.g. attacker.com, operates a web server, and itself from the operating system’s list of running pro- possesses a valid HTTPS certificate for attacker.com. cesses. Analogously, a JavaScript rootkit modifies the We assume the user visits attacker.com where she bookmarklet-visible behavior of a JavaScript environ- invokes her login bookmarklet, but we do not as- ment and escapes detection by overriding the native sume that the user mistakes attacker.com for another JavaScript objects. Because bookmarklets are invoked web site. If the login bookmarklet process normally once a web page is already loaded, a malicious web prompts the user for a master password, we assume page is effectively a rootkit to the bookmarklet’s script. the user enters it at the appropriate time in the login We present attack techniques to corrupt a JavaScript process. We argue this threat model is appropriate for environment in today’s unmodified browsers. The password managers because their purpose is to help the simplest technique shadows a native JavaScript ob- user authenticate to multiple sites without revealing a ject, while the more complex uses explicit JavaScript common password to all the sites. features [9] to defeat an advanced bookmarklet’s reflection-based attempts at detecting our rootkit, and 3. Attack Techniques even to extract the bookmarklet’s full source code, which sometimes reveals inline secrets. We note that The browser’s security model does not erect trust the cat-and-mouse game between a malicious page boundaries within a single JavaScript environment. cloaking its interposed objects and a bookmarklet Therefore, the attacker can employ a number of tech- attempting to detect them unfortunately favors the niques to disrupt the integrity or confidentiality of malicious page, which is loaded first. trusted JavaScript running in an untrusted JavaScript We examined six commercially available login environment. For example, the attacker can shadow the bookmarklets. Using our JavaScript rootkit techniques, names of native objects and emulate their behavior, an attacker can fully compromise all six systems and or the attacker can alter the semantics of built-in extract all of the user’s passwords if the user attempts types by altering their prototype objects. By applying to use his or her bookmarklet when visiting the at- these techniques to the JavaScript’s reflection API, the tacker’s web site. In four of the systems, the attacker attacker can hide these modifications from a book- can construct a rootkit that fools the bookmarklet into marklet that attempts to use introspection to uncover revealing all of the user’s passwords with a single the rootkit. click. In the remaining two cases, the attacker’s rootkit Typically, the attacker modifies the JavaScript en- cannot extract the passwords directly (because the vironment by running malicious JavaScript while the passwords are never present in the attacker’s JavaScript web page is loading, before the honest JavaScript runs. environment), but the attacker can corrupt the book- None of the techniques presented in this section escape marklet’s cross-site scripting filter, which does run the JavaScript sandbox, disrupt JavaScript running in in the attacker’s JavaScript environment, eventually other security origins, or compromise the user’s oper- leading to the full compromise of the user’s password ating system. Not all of these techniques work in all store. browsers, but many of the techniques work in many of We propose a secure design for login bookmarklets the major browsers. that does not rely on the untrusted JavaScript environ- ment for security. We avoid the cat-and-mouse game Shadowing. An attacker can replace native JavaScript between the bookmarklet author and the attacker’s objects in the global scope by declaring global vari- rootkit. Our proposed solution is compatible with web ables with the same name as the native objects. For browsers that comprise 99% of the market and, as a example, suppose the bookmarklet used the following result of our disclosures, has been adopted by several code to determine whether it was running on bank.com: of the login bookmarklet vendors. if (window.location.host == "bank.com") doLogin(password); 2. Threat Model In Internet Explorer and Google Chrome, the attacker The attacker’s goal is to learn the user’s password can disrupt the integrity of this computation by declar- for an honest site, e.g., bank.com. We consider the web ing a global variable named window whose value is attacker threat model [10], with a properly enforced an object with a fake location object: var window = { Using getters and setters, the attacker can emulate location: { host: "bank.com" } }; the behavior of native objects. For example, in Sa- fari 3.1, Google Chrome, and Internet Explorer 8, the When the bookmarklet tries to read the host property attacker can emulate the native location object: of the native location object, the bookmarklet in- stead reads the host property of the fake location window.__defineGetter__("location", object created by the attacker. Notice that the attacker function () { cannot modify the native location object directly return "https://bank.com/login#"; because assigning to the native location object }); navigates the current frame to that location. window.__defineSetter__("location", function (v) { }); Browsers let web pages override native objects to help with compatibility. For example, a pre-release Because the attacker can construct the malicious version of Firefox introduced an immutable JSON JavaScript after seeing the bookmarklet, the attacker object into the global scope, but this change broke a need only emulate the native objects to the extent number of prominent web sites that implemented their necessary to fool the bookmarklet. own JSON object [12]. To avoid breaking these sites, Firefox changed the JSON object to be mutable (e.g., Prototype poisoning. An attacker can also alter the overwritable by attackers). behavior of native objects, such as strings, functions, and regular expressions, by manipulating the prototype of these objects. For example, suppose the bookmarklet Emulation.