Information-Flow-Based Access Control for Web Browsers

Total Page:16

File Type:pdf, Size:1020Kb

Information-Flow-Based Access Control for Web Browsers IEICE TRANS. INF. & SYST., VOL.E92–D, NO.5 MAY 2009 836 PAPER Special Section on Information and Communication System Security Information-Flow-Based Access Control for Web Browsers Sachiko YOSHIHAMA†,††a), Takaaki TATEISHI†, Naoshi TABUCHI†, Nonmembers, and Tsutomu MATSUMOTO††, Member SUMMARY The emergence of Web 2.0 technologies such as Ajax and box holds a DOM (Document Object Model) tree repre- Mashup has revealed the weakness of the same-origin policy [1], the current senting an HTML document. The same-origin policy pro- de facto standard for the Web browser security model. We propose a new hibits access between DOMs or JavaScript objects that be- browser security model to allow fine-grained access control in the client- ff side Web applications for secure mashup and user-generated contents. We long to di erent origins. External script files imported into propose a browser security model that is based on information-flow-based the HTML document by the <script src=’...’ / > access control (IBAC) to overcome the dynamic nature of the client-side elements are regarded as part of the HTML document, and Web applications and to accurately determine the privilege of scripts in the thus run within the same sandbox as the main document. event-driven programming model. key words: Web security, browser security, access control, information- The XMLHttpRequest (XHR) is a de facto standard flow control API that is implemented in most Web browsers. XHR al- lows a client-side script to issue an arbitrary HTTP request 1. Introduction to a remote server. The same-origin policy is also applied to XHR, which means an HTTP request can only be issued to a server that belong to the same-origin as the client-side Ajax offers new modes of Web application construction in- content. However, the emergence of Web 2.0 technologies volving asynchronous data exchanges between the clients such as Ajax and Mashup has revealed design flaws of the (i.e., browsers) and servers, and using JavaScript to update same-origin policy. the GUI via the DOM (Document Object Model) and style First, the same-origin policy assumes that the content sheets. Ajax supports interactive user interfaces without on the same server is mutually trusted, which does not hold reloading the webpages, and this makes possible desktop- for content generated by many users or mashup applications. application-like user experiences for Web applications. For It is quite possible that the content on the same server in- example, word processors and spreadsheets have been the cludes malicious scripts from some users or third parties. In major native desktop applications on PCs, but they can now fact, Cross-Site Scripting attacks have been the most serious be implemented as Ajax applications [2]. security threat to Web applications for some years [3]. Mashup is an application programing model that com- Second, the same-origin sandboxes still need mecha- bines multiple content sources into a single user experience. nisms to allow communication between content from the A typical mashup application might integrate a third-party different origins. A typical example that bypasses the re- map service and a list of stores to interchangeably search striction of XHR is to use the src attribute of an <img> for the shops near some location on the map, or to find the element to send arbitrary information to an arbitrary remote locations of the shops on the map. server, by passing the information as part of the URL request The de facto security policy of current browsers is parameters. This technique is widely used in XSS attacks to called the same-origin policy [1]. The same-origin policy steal session cookies and send them to remote attackers. If assumes that contents (e.g., HTML documents) downloaded an attacker uses the src attribute of a <script> element, from the same server can trust each other, and therefore lim- he can easily implement bi-directional communication be- its the communication between contents from different ori- tween the browser and a remote server, taking advantage gins. The origin of the content is determined by the protocol, of the fact that the returned script content will be executed port number, and the server name of the content URLs. on the client-side [4]. Since the network accesses via URL Each set of same-origin content is confined within a references in the HTML attributes are not under the con- sandbox, which is a browser window or a frame. Each sand- trol of the same-origin policy, an attacker can communicate Manuscript received August 4, 2008. with arbitrary servers without using XHR. Similar loop- Manuscript revised January 2, 2009. holes exist in communications between windows and frames †The authors are with the IBM Tokyo Research Laboratory, on a browser, which are deliberately used by Ajax frame- Yamato-shi, 242–8502 Japan. †† works [5], [6] to enable cross-domain communications. The authors are with the Graduate School of Environment and This paper proposes a new secure browser model that Information Sciences, Yokohama National University, Yokohama- shi, 240–8501 Japan. mitigates the design flaws of the same-origin policy and a) E-mail: [email protected] mitigates the threats to Web applications. In our proposed DOI: 10.1587/transinf.E92.D.836 browser model, all data, i.e., contents received from servers, Copyright c 2009 The Institute of Electronics, Information and Communication Engineers YOSHIHAMA et al.: INFORMATION-FLOW-BASED ACCESS CONTROL FOR WEB BROWSERS 837 are associated with the security label which identifies the attack. origin of the data. The labels represents the security domain DOM-based XSS. The DOM-based XSS is possible when of the URL from which the content is originated. In addi- the client-side application is designed to read a URL tion, the user and each content provider can define the ac- string from document.location, document.URL or cess control policy to control how content (i.e., script) can document.referrer, and inject part of it into the access resources, such as the browser’s internal DOM tree DOM [7]. and the document cookies. The access control policy can also control execution of script as well as network access Once a malicious script is triggered, it is executed by JavaScript (e.g., XMLHttpRequest) and HTML elements within the same-origin sandbox of the innocent content, and and attributes (e.g., by using an <img> element). The ac- therefore allows an attacker to steal document cookies or cess control policy is defined based on the origin of the con- user passwords, or compromise data in a Web application tent. In order to enforce the access control policy properly in for the purpose of phishing [8]. Likewise, Mashup applica- JavaScript, which has dynamic nature, the proposed access tions have the same vulnerabilities as XSS, because third- control model is built on top of information-flowbased ac- party content is often integrated and executed in the same- cess control (IBAC) [13]. In IBAC, the privilege of the con- origin context as trusted content. tent is judged based on the origin of the data used in each op- A common practice to prevent XSS is to filter out eration. The origin of the data is tracked through script ex- scripts on the server side. However, in case of DOM-based ecution. IBAC has advantages over the Stack-based access XSS, server-side filtering is not possible because malicious control (SBAC), a code-origin based access control mech- URLs are handled only on the browser side. Even when the ffi anism which is widely used in Java. Since IBAC assesses server side filtering is logically possible, it is di cult to cor- the privilege of the content not only based on stack inspec- rectly filter data because new ways of bypassing filters are tion but also the origin of method parameters, our proposed constantly invented [9], [10]. It is reported that 73% of Web ff model can enforce access control policies based on the orig- applications su er from XSS vulnerabilities [3]. Therefore, inator of an action even in dynamic and self-mutating client- it is important to provdide a mechanism to protect users side Web applications. from vulnerable Web applications. The rest of the paper is organized as follows: Section 2 describes some attack scenarios. Section 3 offers some ob- 2.1 DOM-Based XSS and Our Approach servations on the access control models. Section 4 describes the detailed design of a secure browser model and its op- This section describes the details of how a DOM-based XSS erational semantics. Section 5 shows the correctness of the works, and how our proposed browser model prevents the proposed model. Section 6 presents an example scenario attack. and evaluates the safety of the model with sample attacks. 1. The user receives a malicious URL, such as Section 7 makes observation on some design decisions. Sec- http://foo.com/bar?name=john#<script>... tion 8 reviews related work. Section 9 concludes the paper ...</script> via a channel outside of the browser, with our future research agenda. such as in spam e-mail. 2. When the URL is passed to the browser, e.g., by 2. Motivating Scenarios: Cross-Site Scripting the user double clicking on the link in the spam mail, the browser sends the HTTP request GET This section describes an attack scenario that is enabled by /bar?name=john to the server foo.com. The fragment the shortcomings of the current browser security model, and identifier after the # sign will not be sent to the server. then gives overview of how the proposed browser model 3. The server foo.com returns a HTML document which prevents the attacks.
Recommended publications
  • CA Network Flow Analysis Release Notes
    CA Network Flow Analysis Release Notes Release 9.1.3 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the “Documentation”) is for your informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Documentation is confidential and proprietary information of CA and may not be disclosed by you or used for any purpose other than as may be permitted in (i) a separate agreement between you and CA governing your use of the CA software to which the Documentation relates; or (ii) a separate confidentiality agreement between you and CA. Notwithstanding the foregoing, if you are a licensed user of the software product(s) addressed in the Documentation, you may print or otherwise make available a reasonable number of copies of the Documentation for internal use by you and your employees in connection with that software, provided that all CA copyright notices and legends are affixed to each reproduced copy. The right to print or otherwise make available copies of the Documentation is limited to the period during which the applicable license for such software remains in full force and effect. Should the license terminate for any reason, it is your responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT.
    [Show full text]
  • Security Analysis of Firefox Webextensions
    6.857: Computer and Network Security Due: May 16, 2018 Security Analysis of Firefox WebExtensions Srilaya Bhavaraju, Tara Smith, Benny Zhang srilayab, tsmith12, felicity Abstract With the deprecation of Legacy addons, Mozilla recently introduced the WebExtensions API for the development of Firefox browser extensions. WebExtensions was designed for cross-browser compatibility and in response to several issues in the legacy addon model. We performed a security analysis of the new WebExtensions model. The goal of this paper is to analyze how well WebExtensions responds to threats in the previous legacy model as well as identify any potential vulnerabilities in the new model. 1 Introduction Firefox release 57, otherwise known as Firefox Quantum, brings a large overhaul to the open-source web browser. Major changes with this release include the deprecation of its initial XUL/XPCOM/XBL extensions API to shift to its own WebExtensions API. This WebExtensions API is currently in use by both Google Chrome and Opera, but Firefox distinguishes itself with further restrictions and additional functionalities. Mozilla’s goals with the new extension API is to support cross-browser extension development, as well as offer greater security than the XPCOM API. Our goal in this paper is to analyze how well the WebExtensions model responds to the vulnerabilities present in legacy addons and discuss any potential vulnerabilities in the new model. We present the old security model of Firefox extensions and examine the new model by looking at the structure, permissions model, and extension review process. We then identify various threats and attacks that may occur or have occurred before moving onto recommendations.
    [Show full text]
  • Inlined Information Flow Monitoring for Javascript
    Inlined Information Flow Monitoring for JavaScript Andrey Chudnov David A. Naumann Stevens Institute of Technology Stevens Institute of Technology Hoboken, NJ 07030 USA Hoboken, NJ 07030 USA [email protected] [email protected] ABSTRACT JS engines are highly engineered for performance, which has Extant security mechanisms for web apps, notably the\same- led some researchers to argue for inlined monitoring for IFC. origin policy", are not sufficient to achieve confidentiality The main contribution of this paper is an inlined IFC mon- and integrity goals for the many apps that manipulate sen- itor that enforces non-interference for apps written in JS. sitive information. The trend in web apps is \mashups" We present the main design decisions and rationale, together which integrate JavaScript code from multiple providers in with technical highlights and a survey of state of the art al- ways that can undercut existing security mechanisms. Re- ternatives. The tool is evaluated using synthetic case studies searchers are exploring dynamic information flow controls and performance benchmarks. (IFC) for JavaScript, but there are many challenges to achiev- ing strong IFC without excessive performance cost or im- On IFC. Browsers and other platforms currently provide practical browser modifications. This paper presents an in- isolation mechanisms and access controls. Pure isolation lined IFC monitor for ECMAScript 5 with web support, goes against integration of app code from multiple providers. using the no-sensitive-upgrade (NSU) technique, together Access controls can be more nuanced, but it is well-known with experimental evaluation using synthetic mashups and that access control policies are safety properties whereas IF performance benchmarks.
    [Show full text]
  • Designing a Browser to Benefit from Multi-Core Silicon
    Designing a Browser to Benefit from Multi-core Silicon Ekioh Ltd, Cambridge UK. [email protected] Abstract This paper investigates the impact of the evolution in processor technology upon HTML browser performance, highlighting some limitations in current browser design and ways in which these limitations can be overcome. It asserts that overcoming these limitations is key to offering 4K UIs on mass-market consumer products in the very near future. Introduction HTML browsers are increasingly being used for Trends of CE Processor Speeds application rendering and user interface (UI) 25 presentation. The driving reasons behind this are that single core dual core quad core browsers reduce UI authoring complexity and provide a 20 level of hardware abstraction which enables authoring to happen in parallel with hardware design. 15 Browser technology has also allowed the application 10 authoring community to grow beyond embedded DMIPS Headline Performance software engineers to include creative designers. This has 5 led to a marked improvement in the visual quality of user Per core Performance interfaces and the look and feel of applications. 0 This flexibility and increased visual quality comes at a Time → cost; the browser is one of the most demanding components within a device and achieving the necessary The headline processing speed of multi-core devices responsiveness directly drives CPU selection benefits from increases in the number of cores and, requirements. indirectly, from reductions in process size. Year on year improvements of around 30% were achieved in headline processing speed over a five year period despite the Processor evolution relatively small performance improvements of each core.
    [Show full text]
  • On the Disparity of Display Security in Mobile and Traditional Web Browsers
    On the Disparity of Display Security in Mobile and Traditional Web Browsers Chaitrali Amrutkar, Kapil Singh, Arunabh Verma and Patrick Traynor Converging Infrastructure Security (CISEC) Laboratory Georgia Institute of Technology Abstract elements. The difficulty in efficiently accessing large pages Mobile web browsers now provide nearly equivalent fea- on mobile devices makes an adversary capable of abusing tures when compared to their desktop counterparts. How- the rendering of display elements particularly acute from a ever, smaller screen size and optimized features for con- security perspective. strained hardware make the web experience on mobile In this paper, we characterize a number of differences in browsers significantly different. In this paper, we present the ways mobile and desktop browsers render webpages that the first comprehensive study of the display-related security potentially allow an adversary to deceive mobile users into issues in mobile browsers. We identify two new classes of performing unwanted and potentially dangerous operations. display-related security problems in mobile browsers and de- Specifically, we examine the handling of user interaction vise a range of real world attacks against them. Addition- with overlapped display elements, the ability of malicious ally, we identify an existing security policy for display on cross-origin elements to affect the placement of honest el- desktop browsers that is inappropriate on mobile browsers. ements and the ability of malicious cross-origin elements Our analysis is comprised of eight mobile and five desktop to alter the navigation of honest parent and descendant el- browsers. We compare security policies for display in the ements. We then perform the same tests against a number candidate browsers to infer that desktop browsers are signif- of desktop browsers and find that the majority of desktop icantly more compliant with the policies as compared to mo- browsers are not vulnerable to the same rendering issues.
    [Show full text]
  • Presto: the Definitive Guide
    Presto The Definitive Guide SQL at Any Scale, on Any Storage, in Any Environment Compliments of Matt Fuller, Manfred Moser & Martin Traverso Virtual Book Tour Starburst presents Presto: The Definitive Guide Register Now! Starburst is hosting a virtual book tour series where attendees will: Meet the authors: • Meet the authors from the comfort of your own home Matt Fuller • Meet the Presto creators and participate in an Ask Me Anything (AMA) session with the book Manfred Moser authors + Presto creators • Meet special guest speakers from Martin your favorite podcasts who will Traverso moderate the AMA Register here to save your spot. Praise for Presto: The Definitive Guide This book provides a great introduction to Presto and teaches you everything you need to know to start your successful usage of Presto. —Dain Sundstrom and David Phillips, Creators of the Presto Projects and Founders of the Presto Software Foundation Presto plays a key role in enabling analysis at Pinterest. This book covers the Presto essentials, from use cases through how to run Presto at massive scale. —Ashish Kumar Singh, Tech Lead, Bigdata Query Processing Platform, Pinterest Presto has set the bar in both community-building and technical excellence for lightning- fast analytical processing on stored data in modern cloud architectures. This book is a must-read for companies looking to modernize their analytics stack. —Jay Kreps, Cocreator of Apache Kafka, Cofounder and CEO of Confluent Presto has saved us all—both in academia and industry—countless hours of work, allowing us all to avoid having to write code to manage distributed query processing.
    [Show full text]
  • Superhacks: Exploring and Preventing Vulnerabilities in Browser Binding
    Short Paper: Superhacks Exploring and Preventing Vulnerabilities in Browser Binding Code Fraser Brown Stanford University [email protected] Abstract Browser binding code is different from—and more com- In this paper, we analyze security vulnerabilities in the binding plicated than—other multi-language systems such as foreign layer of browser code, and propose a research agenda to function interfaces (FFIs). This difference arises for three main prevent these weaknesses with (1) static bug checkers and (2) reasons. First, browser binding code must reconcile different new embedded domain specific languages (EDSLs). Browser runtimes instead of making simple library calls. Second, since vulnerabilities may leak browsing data and sometimes allow the binding layer sits between JavaScript application code and attackers to completely compromise users’ systems. Some of the rest of the browser, browsers often rely on binding-layer these security holes result from programmers’ difficulties with code to implement the same-origin policy [2]. For example, managing multiple tightly-coupled runtime systems—typically binding code must enforce isolation between the JavaScript JavaScript and C++. In this paper, we survey the vulnerabilities running in a page and any cross-origin iframes the page may in code that connects C++ and JavaScript, and explain how embed. Finally, the binding layer must defend against poten- they result from differences in the two languages’ type systems, tially malicious code, since the JavaScript running in browsers memory models, and control flow constructs. With this data, we comes from many disparate parties. design a research plan for using static checkers to catch bugs A buggy binding layer introduces browser vulnerabilities.
    [Show full text]
  • Stealthwatch Release Notes V7.3.0
    Cisco Stealthwatch Release Notes 7.3.0 Table of Contents Introduction 4 Overview 4 Terminology 4 Before You Update 4 Software Version 4 3rd Party Applications 5 Hardware 5 Browsers 5 Alternative Access 5 Hardware 6 Virtual Appliances 6 Alternative Method 6 After You Update 7 What's New 8 Stealthwatch Data Store 8 Data Store Considerations 8 Data Store Architecture 9 User Password Validation Requirements and Enhancements 9 Response Management 10 Rules 11 Actions 11 Exporters 12 Interfaces 12 Customer Success Metrics 12 SMC Failover 13 Configuring Failover 13 Primary and Secondary Roles 14 © 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 2 - Cisco Security Services Exchange 14 SecureX Integration Enhancements 15 Cognitive Integration Enhancements 15 Primary Admin 15 Stealthwatch CIMC and BIOS Firmware Update SWU (M5 Hardware Only) 16 Downloading 16 Installing 16 Contacting support 17 What's Been Fixed 18 Version 7.3.0 18 Known Issues 20 Change Log 27 Release Support Information 28 © 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 3 - Introduction Introduction Overview This document provides information on new features and improvements, bug fixes, and known issues for the Stealthwatch v7.3.0 release. For additional information about Stealthwatch, go to cisco.com. Terminology This guide uses the term “appliance” for any Stealthwatch product, including virtual products such as the Stealthwatch Flow Sensor Virtual Edition (VE). A "cluster" is your group of Stealthwatch appliances that are managed by the Stealthwatch Management Console (SMC). As a subset, a "Data Store cluster" is your group of Data Node appliances that comprise your Data Store.
    [Show full text]
  • Information Flow Control for Event Handling and the DOM in Web Browsers
    Information Flow Control for Event Handling and the DOM in Web Browsers Vineet Rajani Abhishek Bichhawat Deepak Garg Christian Hammer MPI-SWS, Germany Saarland University, Germany MPI-SWS, Germany Saarland University, Germany [email protected] [email protected] [email protected] [email protected] Abstract—Web browsers routinely handle private informa- party code to confidential resources. Although sometimes tion. Owing to a lax security model, browsers and JavaScript provably secure [11], these systems restrict third-party code in particular, are easy targets for leaking sensitive data. Prior to subsets of HTML and JS to enable analysis. work has extensively studied information flow control (IFC) as a mechanism for securing browsers. However, two central More generally, all data protection mechanisms discussed aspects of web browsers — the Document Object Model (DOM) above implement some form of one-time access control and the event handling mechanism — have so far evaded thor- on data available to third-party code. As such, they are ough scrutiny in the context of IFC. This paper advances the completely ineffective when the third-party code legitimately state-of-the-art in this regard. Based on standard specifications needs confidential data to provide functionality, but must and the code of an actual browser engine, we build formal models of both the DOM (up to Level 3) and the event handling be prevented from disclosing it in unexpected ways. In- loop of a typical browser, enhance the models with fine-grained formation flow control (IFC) within the web browser is an taints and checks for IFC, prove our enhancements sound and obvious, holistic method to solve this problem.
    [Show full text]
  • The Total Economic Impact™ of Microsoft Internet Explorer 11 Streamlined Upgrade and Cost Savings Position Companies for the Future
    A Forrester Total Economic Project Director: Impact™ Study Jonathan Lipsitz Commissioned By Microsoft Project Contributor Adrienne Capaldo March 2015 The Total Economic Impact™ Of Microsoft Internet Explorer 11 Streamlined Upgrade And Cost Savings Position Companies For The Future Table Of Contents Executive Summary ............................................................................. 3 Disclosures .......................................................................................... 4 TEI Framework And Methodology ........................................................ 6 The Current State Of Internet Explorer 11 In The Marketplace ............ 7 Analysis .............................................................................................. 10 Financial Summary............................................................................. 22 Microsoft Internet Explorer 11: Overview .......................................... 23 Appendix A: Composite Organization Description ............................ 24 Appendix B: Total Economic Impact™ Overview .............................. 25 Appendix C: Forrester And The Age Of The Customer ..................... 26 Appendix D: Glossary ........................................................................ 27 Appendix E: Endnotes ....................................................................... 27 ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from
    [Show full text]
  • Glossary.Pdf
    2 Contents 1 Glossary 4 3 1 Glossary Technologies Akonadi The data storage access mechanism for all PIM (Personal Information Manager) data in KDE SC 4. One single storage and retrieval system allows efficiency and extensibility not possible under KDE 3, where each PIM component had its own system. Note that use of Akonadi does not change data storage formats (vcard, iCalendar, mbox, maildir etc.) - it just provides a new way of accessing and updating the data.</p><p> The main reasons for design and development of Akonadi are of technical nature, e.g. having a unique way to ac- cess PIM-data (contacts, calendars, emails..) from different applications (e.g. KMail, KWord etc.), thus eliminating the need to write similar code here and there.</p><p> Another goal is to de-couple GUI applications like KMail from the direct access to external resources like mail-servers - which was a major reason for bug-reports/wishes with regard to perfor- mance/responsiveness in the past.</p><p> More info:</p><p> <a href=https://community.kde.org/KDE_PIM/Akonadi target=_top>Akonadi for KDE’s PIM</a></p><p> <a href=https://en.wikipedia.org/wiki/Akonadi target=_top>Wikipedia: Akonadi</a></p><p> <a href=https://techbase.kde.org/KDE_PIM/Akonadi target=_top>Techbase - Akonadi</a> See Also "GUI". See Also "KDE". Applications Applications are based on the core libraries projects by the KDE community, currently KDE Frameworks and previously KDE Platform.</p><p> More info:</p><p> <a href=https://community.kde.org/Promo/Guidance/Branding/Quick_Guide/ target=_top>KDE Branding</a> See Also "Plasma".
    [Show full text]
  • Wanguard Platform 3.0 User Manual
    WANGuard Lite 4.1 User Manual WANGuard Console + WANGuard Sensor Copyright ©2010 Andrisoft SRL All rights reserved. Revision 3.00 WANGuard™ Lite 4.1 User Manual Copyright & trademark notices This editon applies to version 4.1 of the licensed program WANGuard Lite and to all subsequent releases and modifcatons untl otherwise indicated in new editons. Notices References in this publicaton to ANDRISOFT S.R.L. products, programs, or services do not imply that ANDRISOFT S.R.L. intends to make these available in all countries in which ANDRISOFT S.R.L. operates. Evaluaton and verifcaton of operaton in conjuncton with other products, except those expressly designated by ANDRISOFT S.R.L., are the user's responsibility. ANDRISOFT S.R.L. may have patents or pending patent applicatons covering subject mater in this document. Supplying this document does not give you any license to these patents. You can send license inquiries, in writng, to the ANDRISOFT S.R.L. marketng department, [email protected]. Copyright Acknowledgment © ANDRISOFT S.R.L. 2008. All rights reserved. All rights reserved. This document is copyrighted and all rights are reserved by ANDRISOFT S.R.L. No part of this document may be reproduced or transmited in any form or by any means, electronic or mechanical, including photocopying and recording, or by any informaton storage and retrieval system without the permission in writng from ANDRISOFT S.R.L. The informaton contained in this document is subject to change without notce. If you fnd any problems in the documentaton, please report them to us in writng. ANDRISOFT S.R.L.
    [Show full text]