Using Replicated Execution for a More Secure and Reliable Web Browser Hui Xue Nathan Dautenhahn Samuel T. King University of Illinois at Urbana Champaign huixue2, dautenh1, kingst @uiuc.edu { } Abstract Unfortunately, hackers actively exploit these vulnerabil- ities as indicated in reports from the University of Wash- Modern web browsers are complex. They provide a ington [46], Microsoft [61], and Google [49, 48]. high-performance and rich computational environment Both industry and academia have improved the se- for web-based applications, but they are prone to nu- curity and reliability of web browsers. Current com- merous types of security vulnerabilities that attackers modity browsers make large strides towards improving actively exploit. However, because major browser plat- the security and reliability of plugins by using sandbox- forms differ in their implementations they rarely exhibit ing techniques to isolate plugins from the rest of the the same vulnerabilities. browser [62, 33]. However, these browsers still scatter In this paper we present Cocktail, a system that uses security logic throughout millions of lines of code, leav- three different off-the-shelf web browsers in parallel to ing these systems susceptible to browser-based attacks. provide replicated execution for withstanding browser- Current research efforts, like Tahoma [32], the OP web based attacks and improving browser reliability. Cock- browser [36], the Gazelle web browser [59], and the Illi- tail mirrors inputs to each replica and votes on browser nois Browser Operating System [58] all propose build- states and outputs to detect potential attacks, while con- ing new web browsers to improve security. Although tinuing to run. The net effect of Cocktail’s architecture these browsers represent a vast improvement in security is to shift the security burden of the system from complex over monolithic commodity browsers, they require re- browsers to a simplified layer of software. We demon- implementing large portions of the browser to withstand strate that Cocktail can withstand real-world browser attacks. Additionally, all of these browsers exhibit fail- exploits and reliability issues, such as browser crashes, stop behavior when encountering a bug or attempted ex- while adding only 31.5% overhead to page load latency ploit, making them susceptible to browser crashes. times on average, and remaining compatible with popu- This paper presents Cocktail, a system that uses repli- lar web sites. cated execution of multiple existing web browsers to help withstand browser bugs and security vulnerabili- ties. Cocktail runs three different off-the-shelf browsers, 1 Introduction including different plugins, in parallel with the assump- tion that any two of them are unlikely to be vulnerable at The near ubiquity of Internet access has put a wealth the same time or exploited by the same malicious page. of information and ever-increasing opportunities for Cocktail replicates user interaction and network requests social interaction at the fingertips of users. Driving in each of the three browsers, then votes on network this revolution is the modern web browser, which has outputs and browser states to detect any modifications evolved from a relatively simple client application de- resulting from browser bugs or web-based attacks. By signed to display static HTML data into a complex net- mirroring inputs to three different browsers and voting worked operating system tasked with managing the myr- on outputs, Cocktail shifts most of the browser’s secu- iad of web-based applications people use daily. Support rity enforcement into a thin and simple software layer, for dynamic content, multimedia data, and extensibil- while reusing the mature, fast, and feature-rich imple- ity has greatly enriched user’s experiences at the cost of mentation of existing web browsers. increasing the complexity of the browser itself. As a Replicated execution [24, 25, 31] is conceptually result, current web browsers are plagued with security simple, but it is extremely expensive to implement in vulnerabilities, as evidenced by Firefox, Safari, Google practice for security purposes. To prevent replicas from Chrome, Opera, and Internet Explorer reporting 374 new falling victim to the same attack, each replica must be a security vulnerabilities in 2009 and 500 in 2010 [18]. distinct implementation of the same specification, which requires significant development resources. For exam- ple, N-version programming [30] usually requires three !"!#$%&'()* times as many software developers. In contrast Cocktail +"!#$*01##.././* takes advantage of a form opportunistic N-version pro- gramming by using three off-the-shelf browsers directly. !"!#$%&'()* In Cocktail’s case the specification is provided by web !"!#$%&'()* standards bodies [20, 13, 2, 19, 12, 3], and the imple- +"!#$*01##.././* mentations are represented by three major web browsing !"!#$%&'()* +"!#$*,!-)./* systems: Firefox, Opera, and Google Chrome. !"!#$%&'()* Although modern web browsers respect common standards like HTML, HTTP, CSS, JavaScript, and the !"!#$%&'()* Domain Object Model (DOM), most browsers imple- !"!#$%&'()* +"!#$*,!-)./* ment slight modifications to these standard web pro- tocols. These differences require Cocktail to abstract Figure 1. Results of the same exploit being states and to cope with non-determinism between the served!"!#$%&'() to* four different browsers. browsers in order to extract reliable features to vote on for security. Designing these techniques is challeng- ing because developers did not build browsers with N- Version programming in mind. During our experiments, we ran this exploit on Fire- Our experiments show that Cocktail is practical, pre- fox 3.5 and confirmed the existence of the successful vents real attacks, and withstands both reliability issues attack. However, when we opened this same malicious and injected faults. Cocktail’s replicas run in parallel, so page using Internet Explorer, Safari, Chrome, or Opera, there is almost no performance loss. While more sys- these browsers safely avoid the attack, as illustrated in tem resources are required, multi-core systems continue Figure 1, because none of these browsers had this same to gain popularity, making this style of security practical bug. Surprisingly, even older versions of Firefox on on modern computer systems. Windows XP were unaffected by this attack. This differ- Our contributions are: ence in processing the malicious payload motivates our architecture that uses three different browsers to with- Cocktail is the first system to show how to use mul- • stand attacks. tiple browsers as a form of opportunistic N-Version programming for improved security through repli- cated execution. 3 Problem statement, threat model, and We show how to abstract browser states and cope assumptions • with non-determinism to enable the use of existing browsers in Cocktail, despite differences in their Cocktail focuses on providing protection for implementations. browsers and plugins by running different browser implementations in parallel and detecting any inconsis- We demonstrate that Cocktail can withstand a wide • tencies between these browsers. We use three distinct range of real world attacks with little overhead to off-the-shelf browsers and Flash player plugins. the overall browsing experience. We focus on attacks on browsers themselves where an attacker can compromise a browser vulnerability and 2 A motivating example control the browser. In our threat model, we assume that an attacker has On July 13 2009, researchers published a public taken over a web site and can serve arbitrary data to proof-of-concept exploit for Firefox 3.5 [7]. This exploit Cocktail. This data can come via a web site that the attacks a heap overflow vulnerability found in the new user visits directly, or it can come indirectly through a JavaScript just-in-time compiler that Mozilla developers web site that serves off-site network resources, like ads. introduced in Firefox 3.5. With just a single visit to a We assume that this malicious data can result in a com- malicious web page, the attacker can run arbitrary in- promise to any of the browser replicas executing within structions on the victim’s Windows XP computer. With Cocktail, which implies that the attacker has the ability a few minor modifications, this exploit can also com- to execute arbitrary instructions with the full privileges promise the Firefox browser on Linux and Mac OS X to of the replica. execute arbitrary instructions on these platforms as well Currently, Cocktail does not provide any protection [9, 8]. against bugs in web-based applications. Fundamentally, bugs like cross-site scripting [35] and cross-site request To see this more clearly take, for instance, the state forgery [65] result from bugs in the server-side code. abstraction of network requests. If at least two of the The resulting attacks operate within current browser se- three replicas attempt to fetch an image at location curity policies, putting them beyond the scope of Cock- foo.com/image.jpg, then Cocktail will fetch the tail. resource and return the data back to the requesting repli- We trust the layers upon which Cocktail is built. This cas. However, if none of the replicas request the same includes the network component and the visual voter in image then Cocktail will deny the request because it UI component, the libraries that the output component does not reach consensus. By using network requests uses, the Systrace tool we use to build browser