DOCSLIB.ORG

The Security Implications of Google Native Client

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Security Implications of Google Native Client Home Careers Contact Blog Product Services Team The Security Implications Of Google Native Client Chris | May 15th, 2009 | Filed Under: New Findings What would it look like if Google tried to unseat Flash and obsolete all desktop applications? It would look a lot like Google Native Client (NaCl): a mechanism to download a game written in C/C++ from Id Software and run it in your browser, without giving Id Software the ability to take control of your computer. Google NaCl is, on its face, a crazy-talk idea. It’s a browser plugin that downloads native x86 code from a website and runs it on your machine. If this sounds familiar, it’s because Microsoft tried it over a decade ago with ActiveX. If you’re skeptical about the idea, it’s because ActiveX was a security calamity; O.K. an ActiveX control, and it owns your machine almost completely. So the primary obstacle between Google and the future of software delivery is security. Google has a lot of interesting ideas about how to overcome that obstacle. But security people unlikely to take Google’s word for it. So Google held a contest: “we’ll publish the source code, you’ll find flaws. The winner gets $0x2000 USD.” We took the bait. And things were looking great for us. Then Skynet noticed Google, decided it was a threat, and sent a Mark Dowd unit back through time to terminate it. The contest winner hasn’t been declared yet, but as we aren’t a murderous robot made out of liquid metal, we’re guessing we didn’t take first place. But we learned lots of stuff in the process, and so we have stuff to say. And when you get right down to it, isn’t that worth a lot more than money? Think about that, while we share some lessons about NaCl and cry into our discount beers. What is NaCl, and why do I care? Absent any innovations in browsers or HTML, within 5 years, every application normal people use will be run off a web server and rendered via Javascript, HTML, or Flash. That trend is inexorable. You know it and I know it. But what if we want to ship a game title? We need a faster runtime, real graphics, and a decent interaction model. Until recently, if we wanted to run “real” programs behind a browser, we had two options: ActiveX and Java. Consider ActiveX. It’s a really simple idea. In your HTML code, you can specify a URI to a library file. The same kind of libraries your desktop applications use. They’re written in whatever language makes sense to the authors, but they’re delivered as native X86 instructions. They talk to your computer the same way any application does. This is a powerful concept. Virtually anything a desktop app can do, an ActiveX control can do. Unfortunately, read that last sentence again. So that’s a problem. Most security-conscious people aren’t willing to trust random native executables running on their computers off web pages. Consider Java. Java does something that ups the security ante significantly. Instead of delivering raw X86 opcodes, it’s delivering JVM bytecode. The Java plugin either interprets or compiles that bytecode, but either way, the actual instructions executing on your computer and talking to your OS belong to Java. You only have to trust the one native program. But wait, there’s more! Because Java programs don’t execute directly on the CPU, there’s an architectural opportunity to improve security: you can put a security layer in between the program and the operating system. Java calls this the “applet sandbox”. The applet sandbox basically says, “applets can’t talk directly to the OS; instead, they have to use a set of interfaces we created specifically for allowing applets to talk directly to the OS”. You can’t do this with ActiveX, because you’re executing raw X86 instructions. From userland, on an X86 chip, with any reasonable performance, there’s no way to put a layer between Win32 userland (or OS X) and the kernel. If you want that layer there, you have to not execute code off the Internet directly on the CPU. But wait, there’s still more! Because the JVM designers got to design their own virtual machine and controlled the whole runtime, they were able to make Java bytecode very “regular” and very easy to analyze. Java is so easy to analyze that 99% of compiled Java binaries can be decompiled right back to source code. X86 is not regular and easy to analyze. For one thing, X86 instructions come in various shapes and sizes. The shortest X86 instructions (such as “INCR EAX”, or “add 1 to the EAX register”) are one byte long. Because X86 instructions can accept prefixes that change their meanings, the largest X86 instructions are over 10 bytes long. The irregularity of X86 instruction lengths does more than just make instructions tedious to recognize. It also means that, unlike in a RISC architecture where instructions are always, say, 32 bits long, an X86 instruction is not necessarily at an aligned offset in the file. Byte 1024 of an X86 executable is as likely to be the middle of an instruction as it is the beginning of one. Why does this matter? You can’t easily put a layer between a bare-metal X86 program and the OS kernel to keep that program from calling “execve” and running any program it wants. So, instead say you wanted to write an X86 “verifier” that would check programs you ran to make sure they don’t try to call “execve”. You’d have some problems. For starters, because X86 programs can jump pretty much anywhere in their instruction streams, even if you disassembled the program and checked for calls to execve, a malicious program could make a series of innocuous instructions which, when the program jumped into the middle of them, actually executed execve. Second, as anyone who’s ever written overflow shellcode knows, X86 programs can execute out of data. So even if you verified the instruction stream perfectly, the program could use innocuous instructions to create malicious instructions in data that the verifier couldn’t reasonable check. And now we come to the part where we explain why we’re telling you all of this. Behold, Google NaCl! Repurposing an idea from the mid-’90s, NaCl employs a very simple trick to make native X86 programs reliably verifiable. And if you can verify an X86 program, you don’t need a layer between the program and the OS: you can just have rules, and refuse programs that break the rules. The trick is: restrict X86 programs to those that are verifiable. What are those programs? Well, among other things: They must admit to simple disassembly, yielding a stream of recognizable opcodes. This wouldn’t be a strict requirement for an X86 program, but most programs adhere to it anyways. Those opcodes must not jump to anything but the beginning of an instruction recognized by that simple disassembly. Easy to say, tricky to implement, but not a huge design change for most X86 code. They can’t modify the program text itself. (Note that we’re butchering this concept a little; in the literature, it makes a big difference whether you patch a candidate program to safety, or whether you detect unsafeness and halt. But we digress.) With those constraints in place, it turns out NaCl can reliably analyze X86 instructions. The verifier can then add rules: You can’t muck with memory management to fool the verifier. You can’t talk directly to the operating system. Instead, you can call into trusted code in the first 64k of the binary that will make selected system calls for you, just like with a Java applet. There is a very important difference between what NaCl is doing and what Java is doing. Java’s security measures are chaperones. They’re always there and always checking your actions. NaCl’s mechanisms are just rules. They’re checked once, and then the program is on its own. NaCl promises to be faster than Java. More importantly, to build a NaCl program for your customers browsers, you don’t have to port to Java; you just have to use the NaCl build environment (a patched GCC that targets a simple ELF module) on your existing C code. Google, for instance, ported Quake. It is worth mentioning here —- and this is to NaCl’s credit —- that this isn’t a new idea. The fundamental approach dates back to Wahbe et al, from SOSP in 1993 (!). The core ideas that make the approach work on X86 (Write/Jump sandboxing vs. full Read/W/J isolation) are in an 05 MIT TR and Usenix article by Stephen McCamant (then a grad student at MIT) and Greg Morrisett at Harvard. And in 2008, Bryan Ford and Russ Cox released a version of the same idea, called Vx32, that runs on Linux and FreeBSD. Google NaCl would be the first mainstream implementation of the idea. That’s a bit scary, but if you generalize a little bit, the ideas at play here aren’t really all that different from the ideas VMWare relied on; in fact, Vx32 runs code out of basic block caches just like VMWare (and DynamoRIO before it) and oh my god we need to stop geeking out about this now. What could possibly go wrong? . First: assume the X86 verification all just worked.
Load more

Recommended publications
  • Effects and Opportunities of Native Code Extensions For
    Effects and Opportunities of Native Code Extensions for Computationally Demanding Web Applications DISSERTATION zur Erlangung des akademischen Grades Dr. Phil. im Fach Bibliotheks- und Informationswissenschaft eingereicht an der Philosophischen Fakultät I Humboldt-Universität zu Berlin von Dipl. Inform. Dennis Jarosch Präsident der Humboldt-Universität zu Berlin: Prof. Dr. Jan-Hendrik Olbertz Dekan der Philosophischen Fakultät I: Prof. Michael Seadle, Ph.D. Gutachter: 1. Prof. Dr. Robert Funk 2. Prof. Michael Seadle, Ph.D. eingereicht am: 28.10.2011 Tag der mündlichen Prüfung: 16.12.2011 Abstract The World Wide Web is amidst a transition from interactive websites to web applications. An increasing number of users perform their daily computing tasks entirely within the web browser — turning the Web into an important platform for application development. The Web as a platform, however, lacks the computational performance of native applications. This problem has motivated the inception of Microsoft Xax and Google Native Client (NaCl), two independent projects that fa- cilitate the development of native web applications. Native web applications allow the extension of conventional web applications with compiled native code, while maintaining operating system portability. This dissertation determines the bene- fits and drawbacks of native web applications. It also addresses the question how the performance of JavaScript web applications compares to that of native appli- cations and native web applications. Four application benchmarks are introduced that focus on different performance aspects: number crunching (serial and parallel), 3D graphics performance, and data processing. A performance analysis is under- taken in order to determine and compare the performance characteristics of native C applications, JavaScript web applications, and NaCl native web applications.
    [Show full text]
  • Improving System Security Through TCB Reduction
    Improving System Security Through TCB Reduction Bernhard Kauer March 31, 2015 Dissertation vorgelegt an der Technischen Universität Dresden Fakultät Informatik zur Erlangung des akademischen Grades Doktoringenieur (Dr.-Ing.) Erstgutachter Prof. Dr. rer. nat. Hermann Härtig Technische Universität Dresden Zweitgutachter Prof. Dr. Paulo Esteves Veríssimo University of Luxembourg Verteidigung 15.12.2014 Abstract The OS (operating system) is the primary target of todays attacks. A single exploitable defect can be sufficient to break the security of the system and give fully control over all the software on the machine. Because current operating systems are too large to be defect free, the best approach to improve the system security is to reduce their code to more manageable levels. This work shows how the security-critical part of theOS, the so called TCB (Trusted Computing Base), can be reduced from millions to less than hundred thousand lines of code to achieve these security goals. Shrinking the software stack by more than an order of magnitude is an open challenge since no single technique can currently achieve this. We therefore followed a holistic approach and improved the design as well as implementation of several system layers starting with a newOS called NOVA. NOVA provides a small TCB for both newly written applications but also for legacy code running inside virtual machines. Virtualization is thereby the key technique to ensure that compatibility requirements will not increase the minimal TCB of our system. The main contribution of this work is to show how the virtual machine monitor for NOVA was implemented with significantly less lines of code without affecting the per- formance of its guest OS.
    [Show full text]
  • Lock-In-Pop: Securing Privileged Operating System Kernels By
    Lock-in-Pop: Securing Privileged Operating System Kernels by Keeping on the Beaten Path Yiwen Li, Brendan Dolan-Gavitt, Sam Weber, and Justin Cappos, New York University https://www.usenix.org/conference/atc17/technical-sessions/presentation/li-yiwen This paper is included in the Proceedings of the 2017 USENIX Annual Technical Conference (USENIX ATC ’17). July 12–14, 2017 • Santa Clara, CA, USA ISBN 978-1-931971-38-6 Open access to the Proceedings of the 2017 USENIX Annual Technical Conference is sponsored by USENIX. Lock-in-Pop: Securing Privileged Operating System Kernels by Keeping on the Beaten Path Yiwen Li Brendan Dolan-Gavitt Sam Weber Justin Cappos New York University Abstract code needed to run such a system increases the odds that Virtual machines (VMs) that try to isolate untrusted flaws will be present, and, in turn, that tens of millions code are widely used in practice. However, it is often of user machines could be at risk [25]. Furthermore, iso- possible to trigger zero-day flaws in the host Operating lation will not work if a malicious program can access System (OS) from inside of such virtualized systems. In even a small portion of the host OS’s kernel that contains this paper, we propose a new security metric showing a zero-day flaw [12]. Both of these drawbacks reveal the strong correlation between “popular paths” and kernel key underlying weakness in designing OSVM systems – vulnerabilities. We verify that the OS kernel paths ac- a lack of information as to which parts of the host kernel cessed by popular applications in everyday use contain can be safely exported to user programs.
    [Show full text]
  • Open Benchmark Alignment
    Benchmark Selection Guide, Vol. 1 Doing it Right Art Morgan Performance Engineer, Intel Corporation Spring 2015 Legal Disclaimers Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors. Performance tests, such as SYSmark* and MobileMark*, are measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products. For more information go to http://www.intel.com/performance. Intel is a sponsor and member of the BenchmarkXPRT* Development Community, and was the major developer of the XPRT* family of benchmarks. Principled Technologies* is the publisher of the XPRT family of benchmarks. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases. © 2015 Intel Corporation. Intel, Intel Inside and other logos are trademarks or registered trademarks of Intel Corporation, or its subsidiaries in the United States and other countries. * Other names and brands may be claimed as the property of others. 2 About this Guide This guide uses benchmark comparison tables to help you select the right set of tools for Windows*, Android* and Chrome* platform evaluations. Benchmarks covered in this guide: . General Guidance on Platform Evaluations 3DMark* 1.2.0 ANDEBench* PRO AnTuTu* v5.6.1 . Benchmark Selection for Windows BaseMark* CL BatteryXPRT* 2014 CompuBench* CL 1.5 for OpenCL* . Benchmark Selection for Android CompuBench* RS 2.0 for RenderScript* CrXPRT* 2015 Geekbench* 3.3.1 .
    [Show full text]
  • Nacldroid: Native Code Isolation for Android Applications
    NaClDroid: Native Code Isolation for Android Applications Elias Athanasopoulos1, Vasileios P. Kemerlis2, Georgios Portokalidis3, and Angelos D. Keromytis4 1 Vrije Universiteit Amsterdam, The Netherlands [email protected] 2 Brown University, Providence, RI, USA [email protected] 3 Stevens Institute of Technology, Hoboken, NJ, USA [email protected] 4 Columbia University, New York, NY, USA [email protected] Abstract. Android apps frequently incorporate third-party libraries that contain native code; this not only facilitates rapid application develop- ment and distribution, but also provides new ways to generate revenue. As a matter of fact, one in two apps in Google Play are linked with a library providing ad network services. However, linking applications with third-party code can have severe security implications: malicious libraries written in native code can exfiltrate sensitive information from a running app, or completely modify the execution runtime, since all native code is mapped inside the same address space with the execution environment, namely the Dalvik/ART VM. We propose NaClDroid, a framework that addresses these problems, while still allowing apps to include third-party code. NaClDroid prevents malicious native-code libraries from hijacking Android applications using Software Fault Isolation. More specifically, we place all native code in a Native Client sandbox that prevents uncon- strained reads, or writes, inside the process address space. NaClDroid has little overhead; for native code running inside the NaCl sandbox the slowdown is less than 10% on average. Keywords: SFI, NaCl, Android 1 Introduction Android is undoubtedly the most rapidly growing platform for mobile devices, with estimates predicting one billion Android-based smartphones shipping in 2017 [12].
    [Show full text]
  • Vx32: Lightweight User-Level Sandboxing on the X86
    Vx32: Lightweight User-level Sandboxing on the x86 Bryan Ford and Russ Cox Massachusetts Institute of Technology {baford,rsc}@pdos.csail.mit.edu Abstract 1 Introduction Code sandboxing is useful for many purposes, but most A sandbox is a mechanism by which a host software sandboxing techniques require kernel modifications, do system may execute arbitrary guest code in a confined not completely isolate guest code, or incur substantial environment, so that the guest code cannot compromise performance costs. Vx32 is a multipurpose user-level or affect the host other than according to a well-defined sandbox that enables any application to load and safely policy. Sandboxing is useful for many purposes, such execute one or more guest plug-ins, confining each guest as running untrusted Web applets within a browser [6], to a system call API controlled by the host application safely extending operating system kernels [5, 32], and and to a restricted memory region within the host’s ad- limiting potential damage caused by compromised ap- dress space. Vx32 runs guest code efficiently on several plications [19, 22]. Most sandboxing mechanisms, how- widespread operating systems without kernel extensions ever, either require guest code to be (re-)written in a type- or special privileges; it protects the host program from safe language [5,6], depend on special OS-specific facil- both reads and writes by its guests; and it allows the host ities [8, 15, 18, 19], allow guest code unrestricted read to restrict the instruction set available to guests. The key access to the host’s state [29, 42], or entail a substantial to vx32’s combination of portability, flexibility, and effi- performance cost [33,34,37].
    [Show full text]
  • 2018 Webist Lnbip (20)
    Client-Side Cornucopia: Comparing the Built-In Application Architecture Models in the Web Browser Antero Taivalsaari1, Tommi Mikkonen2, Cesare Pautasso3, and Kari Syst¨a4, 1Nokia Bell Labs, Tampere, Finland 2University of Helsinki, Helsinki, Finland 3University of Lugano, Lugano, Swizerland 4Tampere University, Tampere, Finland [email protected], [email protected], [email protected], [email protected] Abstract. The programming capabilities of the Web can be viewed as an afterthought, designed originally by non-programmers for relatively simple scripting tasks. This has resulted in cornucopia of partially over- lapping options for building applications. Depending on one's viewpoint, a generic standards-compatible web browser supports three, four or five built-in application rendering and programming models. In this paper, we give an overview and comparison of these built-in client-side web ap- plication architectures in light of the established software engineering principles. We also reflect on our earlier work in this area, and provide an expanded discussion of the current situation. In conclusion, while the dominance of the base HTML/CSS/JS technologies cannot be ignored, we expect Web Components and WebGL to gain more popularity as the world moves towards increasingly complex web applications, including systems supporting virtual and augmented reality. Keywords|Web programming, single page web applications, web com- ponents, web application architectures, rendering engines, web rendering, web browser 1 Introduction The World Wide Web has become such an integral part of our lives that it is often forgotten that the Web has existed only about thirty years. The original design sketches related to the World Wide Web date back to the late 1980s.
    [Show full text]
  • Sound Loop Superoptimization for Google Native Client
    Sound Loop Superoptimization for Google Native Client Berkeley Churchill Rahul Sharma ∗ JF Bastien Stanford University Microsoft Research India Stanford University [email protected] [email protected] [email protected] Alex Aiken Stanford University [email protected] Abstract rules. Specifically, the rules restrict the addresses of memory Software fault isolation (SFI) is an important technique for accesses and indirect jump targets at runtime. the construction of secure operating systems, web browsers, However, performance is a “significant handicap” for and other extensible software. We demonstrate that super- SFI [38]. Currently, there is a performance penalty that all optimization can dramatically improve the performance of users of NaCl and other SFI implementations pay for the se- Google Native Client, a SFI system that ships inside the curity guarantees. Building an optimizing compiler for SFI Google Chrome Browser. Key to our results are new tech- systems is difficult because of a pronounced phase ordering niques for superoptimization of loops: we propose a new ar- problem: Either a compiler can generate well-formed SFI chitecture for superoptimization tools that incorporates both code and then optimize it for performance, or it can generate a fully sound verification technique to ensure correctness and optimized code and adjust it to obey the SFI rules. Both of a bounded verification technique to guide the search to op- these approaches lead to sub-optimal performance. More- timized code. In our evaluation we optimize 13 libc string over, without verification, the optimizations have no formal functions, formally verify the correctness of the optimiza- guarantees of correctness [26, 30]. tions and report a median and average speedup of 25% over In contrast, search-based program optimization tech- the libraries shipped by Google.
    [Show full text]
  • Mitigating Javascript's Overhead with Webassembly
    Samuli Ylenius Mitigating JavaScript’s overhead with WebAssembly Faculty of Information Technology and Communication Sciences M. Sc. thesis March 2020 ABSTRACT Samuli Ylenius: Mitigating JavaScript’s overhead with WebAssembly M. Sc. thesis Tampere University Master’s Degree Programme in Software Development March 2020 The web and web development have evolved considerably during its short history. As a result, complex applications aren’t limited to desktop applications anymore, but many of them have found themselves in the web. While JavaScript can meet the requirements of most web applications, its performance has been deemed to be inconsistent in applications that require top performance. There have been multiple attempts to bring native speed to the web, and the most recent promising one has been the open standard, WebAssembly. In this thesis, the target was to examine WebAssembly, its design, features, background, relationship with JavaScript, and evaluate the current status of Web- Assembly, and its future. Furthermore, to evaluate the overhead differences between JavaScript and WebAssembly, a Game of Life sample application was implemented in three splits, fully in JavaScript, mix of JavaScript and WebAssembly, and fully in WebAssembly. This allowed to not only compare the performance differences between JavaScript and WebAssembly but also evaluate the performance differences between different implementation splits. Based on the results, WebAssembly came ahead of JavaScript especially in terms of pure execution times, although, similar benefits were gained from asm.js, a predecessor to WebAssembly. However, WebAssembly outperformed asm.js in size and load times. In addition, there was minimal additional benefit from doing a WebAssembly-only implementation, as just porting bottleneck functions from JavaScript to WebAssembly had similar performance benefits.
    [Show full text]
  • Advanced Development of Certified OS Kernels Prof
    Advanced Development of Certified OS Kernels Zhong Shao (PI) and Bryan Ford (Co-PI) Department of Computer Science Yale University P.O.Box 208285 New Haven, CT 06520-8285, USA {zhong.shao,bryan.ford}yale.edu July 15, 2010 1 Innovative Claims Operating System (OS) kernels form the bedrock of all system software—they can have the greatest impact on the resilience, extensibility, and security of today’s computing hosts. A single kernel bug can easily wreck the entire system’s integrity and protection. We propose to apply new advances in certified software [86] to the development of a novel OS kernel. Our certified kernel will offer safe and application-specific extensibility [8], provable security properties with information flow control, and accountability and recovery from hardware or application failures. Our certified kernel builds on proof-carrying code concepts [74], where a binary executable includes a rigorous machine-checkable proof that the software is free of bugs with respect to spe- cific requirements. Unlike traditional verification systems, our certified software approach uses an expressive general-purpose meta-logic and machine-checkable proofs to support modular reason- ing about sophisticated invariants. The rich meta-logic enables us to verify all kinds of low-level assembly and C code [10,28,31,44,68,77,98] and to establish dependability claims ranging from simple safety properties to advanced security, correctness, and liveness properties. We advocate a modular certification framework for kernel components, which mirrors and enhances the modularity of the kernel itself. Using this framework, we aim to create not just a “one-off” lump of verified kernel code, but a statically and dynamically extensible kernel that can be incrementally built and extended with individual certified modules, each of which will provably preserve the kernel’s overall safety and security properties.
    [Show full text]
  • Visualization of Prague Castle
    Master’s Thesis Czech Technical University in Prague Faculty of Electrical Engineering F3 Department of Computer Graphics and Interaction Visualization of Prague Castle Bc. Antonín Smrček Study Programme: Open Informatics Field of Study: Computer Graphics and Interaction January 2016 Supervisor: prof. Ing. Jiří Žára, CSc. Acknowledgement / Declaration I would like to thank prof. Ing. Jiří I hereby declare that I have completed Žára, CSc., for supervision of my the- this thesis independently and that I have sis. He provided me with invaluable in- listed all the literature and publications sights, feedback on work in progress and used. his guidance was especially important I have no objection to usage of this in finishing stages of the project. My work in compliance with the act §60 thanks are also due to all friends who Zákon č. 121/2000Sb. (copyright law), helped me with the user testing. Finally, and with the rights connected with the I want to particularly thank my mother copyright act including the changes in for her support throughout my studies. the act. In Prague on January 11, 2016 ........................................ v Abstrakt / Abstract Tato diplomová práce se zabývá vý- This thesis describes a development vojem webové aplikace která vizualizuje of the web-based 3D virtual walk ap- prostředí Pražského hradu a umožňuje plication which visualizes the Prague 3D virtuální procházku v rámci jeho Castle and provides the users with an prostor. Důraz je kladen na grafic- information about interesting objects kou kvalitu a výkon aplikace. Obdobné in the area, with focus on graphical systémy pro vizualizaci měst jsou podro- quality and performance of the ap- beny analýze a jsou diskutovány možné plication.
    [Show full text]
  • CIS 4360 Secure Computer Systems Sandboxing: Google Native Client
    CIS 4360 Secure Computer Systems Sandboxing: Google Native Client Professor Qiang Zeng Spring 2017 Some slides are stolen from Intel docs Previous Class • SGX ensures confidentiality and integrity of data and code in an enclave • Only the Intel processors and the enclave need be trusted • Secrets are provisioned (through e.g. SSL) to enclaves only after they have been attested CIS 4360 – Secure Computer Systems 2 When you want to run trusted code to process security-sensi8ve data, what can you rely on? Intel SGX CIS 4360 – Secure Computer Systems 3 When you want to run untrusted code, what should you use? Sandboxing is a good op8on Google’s Nave Client is an example of Sandboxing technique CIS 4360 – Secure Computer Systems 4 What is Native Client? • Native Client is a sandboxing technique for running compiled C and C++ code in the browser efficiently and securely, independent of the user’s operating system CIS 4360 – Secure Computer Systems 5 • CIS 4360 – Secure Computer Systems 6 We already have JavaScript, which is safe and portable; why do we s8ll want Nave Client? Performance (code is executed navely rather than interpreted) Numerous legacy C/C++ code can be migrated to Web CIS 4360 – Secure Computer Systems 7 • CIS 4360 – Secure Computer Systems 8 CIS 4360 – Secure Computer Systems 9 Wait! Downloading nave code from Internet and running it in my browser? Are you insane? Your concern is valid. That is exactly why we need a sandbox for running nave code in the browser CIS 4360 – Secure Computer Systems 10 Benefits of Native Client •
    [Show full text]