DOCSLIB.ORG

The Unexpected Dangers of Dynamic Javascript

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Unexpected Dangers of Dynamic Javascript The Unexpected Dangers of Dynamic JavaScript Sebastian Lekies, Ruhr-University Bochum; Ben Stock, Friedrich-Alexander-Universität Erlangen-Nürnberg; Martin Wentzel and Martin Johns, SAP SE https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/lekies This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX The Unexpected Dangers of Dynamic JavaScript Sebastian Lekies Ben Stock Martin Wentzel Ruhr-University Bochum FAU Erlangen-Nuremberg SAP SE [email protected] [email protected] [email protected] Martin Johns SAP SE [email protected] Abstract the fly. In turn, this enabled the transformation of the Web’s initial document-centric nature into the versatile Modern Web sites frequently generate JavaScript on-the- platform that we know today. fly via server-side scripting, incorporating personalized 2. Browser-driven Web front-ends: Furthermore, the user data in the process. In general, cross-domain access Web browser has proven to be a highly capable container to such sensitive resources is prevented by the Same- for server-provided user interfaces and application logic. Origin Policy. The inclusion of remote scripts via the Thanks to the flexible nature of the underlying HTML HTML script tag, however, is exempt from this policy. model and the power of client-side scripting via Java- This exemption allows an adversary to import and exe- Script, the server can push arbitrary user interfaces to the cute dynamically generated scripts while a user visits an browser that rival their counterparts of desktop applica- attacker-controlled Web site. By observing the execution tion. In addition, and unlike monolithic desktop appli- behavior and the side effects the inclusion of the dynamic cations, however, browser-based UIs enable easy incor- script causes, the attacker is able to leak private user data poration of content from multiple parties using HTML’s leading to severe consequences ranging from privacy vi- inherent hypertext capabilities. olations up to full compromise of user accounts. Based on this foundation, the recent years have shown Although this issues has been known for several years an ongoing shift from Web applications that host the ma- under the term Cross-Site Script Inclusion, it has not jority of their application logic on the server side towards been analyzed in-depth on the Web. Therefore, to sys- rich client-side applications, which use JavaScript to re- tematically investigate the issue, we conduct a study on alize a significant portion of their functionality within the its prevalence in a set of 150 top-ranked domains. We user’s browser. observe that a third of the surveyed sites utilize dynamic With the increase of the functionality implemented on JavaScript. After evaluating the effectiveness of the de- the client side, the necessity for the JavaScript code to ployed countermeasures, we show that more than 80% gain access to additional user data rises natrually. In this of the sites are susceptible to attacks via remote script paper, we explore a specific technique that is frequently inclusion. Given the results of our study, we provide a used to pull such data from the server to the client-side: secure and functionally equivalent alternative to the use Dynamic JavaScript generation. of dynamic scripts. Similar to HTML, which is often generated dynam- ically, JavaScript may also be composed on the fly 1 Introduction through server-side code. In this composition process, user-specific data is often included in the resulting script Since its beginning in the early nineties, the Web evolved code, e.g., within the value of a variable. After deliv- from a mechanism to publish and link static documents ering the script to the browser, this data is immediately into a sophisticated platform for distributed Web applica- available to the client-side logic for further processing tions. This rapid transformation was driven by two tech- and presentation. This practice is potentially dangerous nical cornerstones: as the inclusion of script files is exempt from the Same- 1. Server-side generation of code: For one, on the Origin Policy [23]. Therefore, an attacker-controlled server side, static HTML content was quickly replaced Web page is able to import such a dynamically gener- by scripting to dynamically compose the Web server’s ated script and observe the side effects of the execu- HTTP responses and the contained HTML/JavaScript on tion, since all included scripts share the global object USENIX Association 24th USENIX Security Symposium 723 of the embedding web document. Thus, if the script 2 Technical Background contains user-specific data, this data might be accessi- ble to other attacker-controlled JavaScript. Although this In this section, we cover the technical background rele- attack, dubbed Cross-Site Script Inclusion (XSSI), has vant for this work. been mentioned within the literature [31], the prevalence of flaws which allow for this attack vector has not been 2.1 The Same-Origin Policy studied on real-world Web sites. In this paper we therefore present the first, systematic The Same-Origin Policy (SOP) is the principal security analysis of this vulnerability class and provide empirical policy in Web browsers. The SOP strongly separates mu- evidence on its severeness. First, we outline the general tually distrusting Web content within the Web browser attack patterns and vectors that can be used to conduct through origin-based compartmentalization [23]. More such an attack. Furthermore, we present the results of an precisely, the SOP allows a given JavaScript access only empirical study on several high-profile domains, show- to resources that have the same origin. The origin is de- ing how these domains incorporate dynamic scripts into fined as the triple consisting of scheme, host, and port their applications. Thereby, we find evidence that many of the involved resources. Thus, for instance, a script of these scripts are not or only inadequately protected executed under the origin of attacker.org is not able against XSSI attacks. We demonstrate the sever conse- to access a user’s personal information rendered under quences of these data leaks by reporting on real-world webmail.com. exploitation scenarios ranging from de-anonymization, While JavaScript execution is subject to the SOP, the to targeted phishing attacks up to complete compromise same does not hold true for cross-domain inclusion of of a victim’s account. Web content using HTML tags. Following the initial hy- To summarize, we make the following contributions: pertext vision of the WWW HTML-tags, such as image, may reference resources from foreign origins and include We elaborate on different ways an attacker is capa- • them into the current Web document. ble of leaking sensitive data via dynamically gener- Using this mechanism, the HTML script tag can ated scripts, enabled by the object scoping and dy- point to external script resources, using the tag’s src at- namic nature of JavaScript. tribute. When the browser encounters such a tag, it issues We report on the results of an empirical study a request to the foreign domain to retrieve the referenced • on several high-ranked domains to investigate the script. Important to note in this instance is the fact that prevalence of dynamic scripts. the request also carries authentication credentials in the form of cookies which the browser might have stored for Using the data collected during our empirical study, the remote host. When the response arrives, the script • we show that many dynamic scripts are not properly code inherits the origin of the including document and is protected against XSSI attacks. To demonstrate the executed in the context of the hosting page. This mecha- severity of the outlined vulnerabilities, we present nism is used widely in the Web, for instance to consume different exploitation scenarios ranging from de- third party JavaScript services, such as traffic analysis or anonymization to complete hijacking of a victim’s advertisement reselling [24]. account. Based on the observed purposes of the dynamic 2.2 JavaScript Language Features • scripts encountered in our study, we discuss secure In the following, we cover the most important JavaScript ways of utilizing such data without the use of dy- concepts necessary for the rest of the paper. namically generated scripts. The remainder of the paper is structured as follows: In Scoping In JavaScript, a scope is “a lexical environ- Section 2, we explain the technical foundations needed ment in which a function object is executed” [6]. From a for rest of the paper. Section 3 then covers the general at- developer’s point of view, a scope is the region in which tack patterns and techniques to exploit cross-domain data an identifier is defined. While C++ or Java make use leakage vulnerabilities. In Section 4, we report on the re- of block scoping, JavaScript utilizes so-called function sults of our empirical study and analyze the underlying scoping. This means that the JavaScript engine creates purposes of dynamic scripts. Furthermore, in Section 5, a new scope for each new function it encounters. As a we provide a scheme that is functionally equivalent, but consequence, an identifier that is locally defined in such is not prone to the attacks described in this paper. Sec- a function is associated with the corresponding scope. tion 6 covers related work, Section 7 gives an outlook Only code that is defined within the same function is thus and Section 8 concludes the paper. able to access such a variable residing in the local scope, 724 24th USENIX Security Symposium USENIX Association whereas global variables are associated with the global 3 Cross-Domain Data Leakages scope.
Load more

Recommended publications
  • Protecting Browser State from Web Privacy Attacks
    Protecting Browser State from Web Privacy Attacks Collin Jackson Andrew Bortz Stanford University Stanford University [email protected] [email protected] Dan Boneh John C Mitchell Stanford University Stanford University [email protected] [email protected] ABSTRACT malicious attackers is critical for privacy and security, yet Through a variety of means, including a range of browser this task often falls by the wayside in the push for function- cache methods and inspecting the color of a visited hyper- ality. link, client-side browser state can be exploited to track users An important browser design decision dating back to Net- against their wishes. This tracking is possible because per- scape Navigator 2.0 [10] is the \same-origin" principle, which sistent, client-side browser state is not properly partitioned prohibits web sites from different domains from interacting on per-site basis in current browsers. We address this prob- with another except in very limited ways. This principle lem by refining the general notion of a \same-origin" policy enables cookies and JavaScript from sites of varying trust- and implementing two browser extensions that enforce this worthiness to silently coexist on the user's browser without policy on the browser cache and visited links. interfering with each other. It is the failure to apply an ap- We also analyze various degrees of cooperation between propriate adaptation of the same-origin principle to all per- sites to track users, and show that even if long-term browser sistent browser state that is the source of the most alarming state is properly partitioned, it is still possible for sites to web privacy leaks.
    [Show full text]
  • Automated Cross-Browser Compatibility Testing
    Automated Cross-Browser Compatibility Testing ∗ Ali Mesbah Mukul R. Prasad Electrical and Computer Engineering Trusted Systems Innovation Group University of British Columbia Fujitsu Laboratories of America Vancouver, BC, Canada Sunnyvale, CA, USA [email protected] [email protected] ABSTRACT web browsers render web content somewhat differently [18, With the advent of Web 2.0 applications and new browsers, 24, 25, 26]. However, the scope and impact of this problem the cross-browser compatibility issue is becoming increas- has been rapidly growing due to two, fairly recent trends. ingly important. Although the problem is widely recognized First, modern, rich-content web applications have a heavy among web developers, no systematic approach to tackle client-side behavioral footprint, i.e., they are designed to ex- it exists today. None of the current tools, which provide ecute significant elements of their behavior exclusively on the screenshots or emulation environments, specifies any notion client-side, typically within the web browser. Further, tech- of cross-browser compatibility, much less check it automat- nologies such as Ajax [12], Flash, and event-handling for ically. In this paper, we pose the problem of cross-browser dynamic HTML, which support this thick-client behavior, compatibility testing of modern web applications as a `func- are the very aspects in which web browsers differ. tional consistency' check of web application behavior across Second, recent years have seen an explosion in the num- different web browsers and present an automated solution ber of available web browsers. There are nearly 100 different for it. Our approach consists of (1) automatically analyzing web browsers available today [31].
    [Show full text]
  • Cgi Environment Variables
    Appendix A CGI ENVIRONMENT VARIABLES The original specification for the Common Gateway Interface (CGI) established a list of environment variables, or aspects of the server and of the users connec- The complete CGI specification, http:// tion that would always be made known to CGI scripts. These variables remain a hoohoo.ncsa.uiuc.edu/cgi/ basic part of writing CGI scripts and have also been adopted in other server-side interface.html scripting languages, including server-side includes, ASP, and PHP. This list of the CGI environment variables below is annotated. SERVER_SOFTWARE The name and complete version information of the Web server software. Some server-side software adds itself to SERVER_SOFTWARE string. For example, Apache/1.3.26 (Unix) PHP/4.2.3. SERVER_NAME The servers domain name or IP address. GATEWAY_INTERFACE The version of the CGI specification in use. For example, CGI/1.1. CGI scripts are executable programs that can also be run as command-line programs on the server. The script can use the presence of a GATEWAY_INTERFACE environment variable to determine that it is being run as a CGI script. SERVER_PROTOCOL The communications protocol and version number used to request the script. For example, HTTP/1.1. SERVER_PORT Library Technology Reports The port number to which the request was sent. Sites running Web services on ports other than the default of 80 may want scripts to behave differently for users on different ports. REQUEST_METHOD The HTTP method used for the request. For example, GET or POST. A common use of this variable is have one script handle both the job of displaying a form to the user and of handling the forms submission.
    [Show full text]
  • Fingerprinting Information in Javascript Implementations
    Fingerprinting Information in JavaScript Implementations Keaton Moweryy, Dillon Bogenreif*, Scott Yilek*, and Hovav Shachamy yDepartment of Computer Science and Engineering *Department of Computer and Information Sciences University of California, San Diego University of St. Thomas La Jolla, California, USA Saint Paul, Minnesota, USA ABSTRACT employ additional means to identify the user and the sys- To date, many attempts have been made to fingerprint users tem she is using. Hardware tokens are appropriate in certain on the web. These fingerprints allow browsing sessions to be settings, but their cost and inconvenience form a barrier to linked together and possibly even tied to a user's identity. ubiquitous use. For such sites, browser and user fingerprints They can be used constructively by sites to supplement tra- form an attractive alternative to hardware tokens. On the ditional means of user authentication such as passwords; and (reasonable) assumption that typical users will usually log they can be used destructively to counter attempts to stay in from a single machine (or, at most, a handful), JavaScript anonymous online. fingerprinting allows sites to harden passwords against ac- In this paper, we identify two new avenues for browser fin- count hijacking with a minimum of user inconvenience. gerprinting. The new fingerprints arise from the browser's Destructively, fingerprints can also be used to identify JavaScript execution characteristics, making them difficult and track users, even when those users wish to avoid be- to simulate or mitigate in practice. The first uses the innate ing tracked. The most familiar browser fingerprinting tech- performance signature of each browser's JavaScript engine, nology is the cookie, a client-side datastore partitioned by allowing the detection of browser version, operating system domain and path.
    [Show full text]
  • Invasive Browser Sniffing and Countermeasures
    Invasive Browser Sniffing and Countermeasures Markus Jakobsson Sid Stamm Indiana University Indiana University Bloomington, Indiana USA Bloomington, Indiana USA [email protected] [email protected] ABSTRACT credentials; subjects in the control group received an email We describe the detrimental effects of browser cache/history appearing to come from an unknown person within the same sniffing in the context of phishing attacks, and detail an ap- domain as themselves. Even though the same statistics may proach that neutralizes the threat by means of URL person- not apply to the general population of computer users, it is alization; we report on an implementation performing such clear that it is a reasonably successful technique of luring personalization on the fly, and analyze the costs of and se- people to sites where their browsers silently will be interro- curity properties of our proposed solution. gated and the contents of their caches sniffed. Once a phisher has created an association between an email address and the contents of the browser cache/history, Categories and Subject Descriptors then this can be used to target the users in question with H.4.3 [Information Systems]: Communications Applica- phishing emails that – by means of context – appear plausi- tions—Information browsers ble to their respective recipients. For example, phishers can infer online banking relationships (as was done in [4]), and General Terms later send out emails appearing to come from the appro- priate financial institutions. Similarly, phishers can detect Security, Human Factors possible online purchases and then send notifications stating that the payment did not go through, requesting that the Keywords recipient follow the included link to correct the credit card Browser cache, cascading style sheets, personalization, phish- information and the billing address.
    [Show full text]
  • Intermediaries: Ways of Exploiting New Technologies a Number of New Technologies Have Emerged Recently, Such As HTML 4.0, CSS2.0, XML and HTTP 1.1
    Web Focus Corner: Intermediaries: Ways Of Exploiting New Technologies A number of new technologies have emerged recently, such as HTML 4.0, CSS2.0, XML and HTTP 1.1. Other new web technologies appear to be waiting, just around the corner. But we can't expect all users to upgrade to the latest version of their favourite browser. In this article Brian Kelly describes ways in which new technologies can be deployed. Since February 1998 HTML 4.0 [1], CSS 2.0[2], the Mathematical Markup Language MathML [3] and the Extensible Markup Language XML [4] have all become W3C Recommendations. These web protocols, all of which are concerned with the way in which information can be represented and displayed, were initially Working Drafts which were developed by the appropriate W3C Working Group. The Working Drafts were then made publicly available as W3C Proposed Recommendations. Following a review period the Proposed Recommendations were voted on by W3C member organisations. Following a successful vote, the Proposed Recommendations became Recommendations. But how widely used are these new web protocols? Today's web community, being so large and consisting of a majority who probably have little interest in the underlying web technologies, is reluctant to upgrade to new versions of browsers, due to a lack of knowledge, interest, technical skills or resources. More experienced web users remember the "browser wars" and the problems of being an early adopter of technologies. What are the implications of this conservatism? Can we simply ignore these new technologies? Revisiting the recommendations and looking at the new features they provide it would appear that we cannot afford to ignore these technologies if we wish to develop richer, more elegant and more maintainable web services.
    [Show full text]
  • Browseraudit: Automated Testing of Browser Security Features
    ifact t * r * Comple t te A A n * te W E is s * e C n l l o D C A o * * c T BrowserAudit: Automated Testing u e m S s E u e S e n I R t v e o d t y * s E a * a l d u e a of Browser Security Features t Charlie Sergio Maffeis Chris Novakovic Hothersall-Thomas Department of Computing Department of Computing Netcraft Ltd, UK Imperial College London, UK Imperial College London, UK [email protected] [email protected] [email protected] ABSTRACT As such, browsers need to offer a variety of standardised The security of the client side of a web application relies on security mechanisms which can be relied upon uniformly browser features such as cookies, the same-origin policy and by the client side of web applications, in order to deliver HTTPS. As the client side grows increasingly powerful and security guarantees to their users. For example, the same- sophisticated, browser vendors have stepped up their offering origin policy (SOP) [34] is effective at preventing a range of security mechanisms which can be leveraged to protect of cross-site scripting (XSS) attacks [38] against users' web it. These are often introduced experimentally and informally browsers and is an integral aspect of modern web-based se- and, as adoption increases, gradually become standardised curity. On the other hand, it is sometimes excessively strict; (e.g., CSP, CORS and HSTS). Considering the diverse land- for instance, it forbids the sharing of information between scape of browser vendors, releases, and customised versions different subdomains, a common requirement of large web for mobile and embedded devices, there is a compelling need sites.
    [Show full text]
  • 8 Myths About Mobile Optimization
    8 MYTHS ABOUT MOBILE OPTIMIZATION EXPLORE THE MOST COMMON MISCONCEPTIONS AROUND BUILDING MOBILE FRIENDLY SITES Introduction Did you use Google today? What about Amazon, Twitter or Netflix? If so, you have benefitted from device detection technology. Far from being outdated, device detection is more important than ever as the web is becoming increasingly global and is consumed on a wide range of devices. These days, it’s truly a world-wide web. Some web users are using powerful desktop PCs with big screens and high speed fibre connections; others are using mobile devices with unreliable 3G, data connections or airport WiFi. To think that the same web experience will work well for both is delusional, not to mention bad for business. Device detection helps smooth out these bumps in the user experience by helping to tailor the experience to the user. Tailoring the user experience means happier users and wider market reach. In this guide we will help you understand why the top web brands are all using device detection to deliver world-class experiences on the web. Ronan Cremin, DeviceAtlas CTO 8 Mobile Optimization Myths Myth #1 You need a separate mobile URL, unless you use responsive design. Some people may think there are only two options for a mobile-optimized site: you either go responsive, or build a mobile site with a different URL. This opinion assumes that the mobile site must be a very basic, useless version of the desktop site making mobile users tap the ‘switch to desktop’ button as soon as they can find it.
    [Show full text]
  • HTML5 for Publishing Decision Makers: the Technology Behind the Scenes of Interactive Books Q&A Webinar
    webinar Q&A HTML5 for Publishing Decision Makers: The Technology Behind the Scenes of Interactive Books Unanswered Questions from the March 26, 2013 Live Event Respondents: Jean Kaplansky, Solutions Architect, Aptara | Maria Bartoszewicki, Director of Interactive eBooks, Aptara Moderator: Jeremy Greenfield, Digital Book World Question Answer Where can a publishing house get With regard to information for appropriate business models to distribute content, information on appropriate business Google is your friend here. The first thing you need to start looking at is information models for starting to distribute their about content strategy in general. Business rules and content strategy drive content digitally? Guidance in working requirements for creation, production, all the way through distribution. One of the contracts with authors, working with best ways to get an introduction to this aspect of working with eBooks and previously published books, etc. would interactive content is to attend conferences like DBW and TOCC, where things like be appreciated. contacts and working with previously published books are discussed in conference sessions and sometimes during keynote speeches. –JK What is your opinion on the continued If your business requirements and content strategy dictate that you are going to use of Flash for highly interactive distribute content to the iOS platform, then Flash should not be used. If distribution content? to mobile platforms is a known future business requirement, then project teams should start investigating whether or not they can implement an HTML5-based solution now in order to create interactive content that will not have to be completely converted or rewritten in the future.
    [Show full text]
  • Atlantis: Robust, Extensible Execution Environments for Web Applications
    Atlantis: Robust, Extensible Execution Environments for Web Applications James Mickens Mohan Dhawan Microsoft Research Rutgers University [email protected] [email protected] ABSTRACT variety of standards that define the software stack for web Today’s web applications run inside a complex browser en- applications [14, 19, 36, 52, 55]. In practice, the aggregate vironment that is buggy, ill-specified, and implemented in specification is so complex that it is difficult for any browser different ways by different browsers. Thus, web applications to implement it properly. To further complicate matters, that desire robustness must use a variety of conditional code browser vendors often add new features without consulting paths and ugly hacks to deal with the vagaries of their run- other vendors. Thus, each browser defines an idiosyncratic time. Our new exokernel browser, called Atlantis, solves JavaScript interpreter, HTML parser, and layout engine. this problem by providing pages with an extensible execu- tion environment. Atlantis defines a narrow API for basic These components are loosely compatible across different services like collecting user input, exchanging network data, vendors, but fine-tuning an application for multiple brows- and rendering images. By composing these primitives, web ers often means developing specialized application code in- pages can define custom, high-level execution environments. tended for just one browser. For example: Thus, an application which does not want a dependence on Atlantis’ predefined web stack can selectively redefine com- • Writing a portable web-based GUI is challenging be- ponents of that stack, or define markup formats and script- cause different browsers handle mouse and keyboard ing languages that look nothing like the current browser run- events in different, buggy ways (§2.4.1).
    [Show full text]
  • HTML5 Advertising Going Forward ������������������������������������������������������������325
    www.it-ebooks.info For your convenience Apress has placed some of the front matter material after the index. Please use the Bookmarks and Contents at a Glance links to access them. www.it-ebooks.info Contents at a Glance Foreword ��������������������������������������������������������������������������������������������������������������������������� xix About the Author ��������������������������������������������������������������������������������������������������������������� xxi About the Technical Reviewer ����������������������������������������������������������������������������������������� xxiii Acknowledgments ������������������������������������������������������������������������������������������������������������ xxv Introduction �������������������������������������������������������������������������������������������������������������������� xxvii ■ Chapter 1: The Campaign Process �������������������������������������������������������������������������������������1 ■ Chapter 2: Evolution of Advertising Technology ��������������������������������������������������������������21 ■ Chapter 3: Advertising with Web Standards ��������������������������������������������������������������������37 ■ Chapter 4: Using Canvas, SVG, and Web Fonts ����������������������������������������������������������������61 ■ Chapter 5: Animations and Presentations �����������������������������������������������������������������������85 ■ Chapter 6: HTML5 APIs ��������������������������������������������������������������������������������������������������121
    [Show full text]
  • An Enhanced Sniffing Tool for Network Management
    IOSR Journal of Computer Engineering (IOSR-JCE) e-ISSN: 2278-0661,p-ISSN: 2278-8727, Volume 21, Issue 1, Ser. III (Jan - Feb 2019), PP 26-34 www.iosrjournals.org An enhanced Sniffing Tool for Network Management Bukie, P. T.1 Oyo-Ita, E.U.2Ideba, M. E.3 Oboyi, J.4 Department of Computer Science, University of Calabar Department of Computer Science, Cross River University of Technology, Calabar Department of Computer Science, University of Calabar Department of Mathematics, University of Calabar Corresponding Author: Bukie, P. T. Abstract:The use of packet sniffers is most effective in monitoring and troubleshootingcomputer networksagainst vulnerabilities mostly threaten data security and integrity. However, an initial investigation showed that the efficiency of existing packet sniffing platforms suffered setbacks in the areas of malware detection, platform dependency and user interface. As such, an easy graphical user interface (GUI) and minimal memory requirements were established asthe most essential features required to effectively monitor network activities. This report analyses the limitations of existing packet sniffing tools, using an Object- OrientedModelling (OOM) design methodology; in a bid to develop a platform independent tool with simpler GUI, better performance and security whereby a user can perform different routines built into the packet sniffing system by selecting the File or View menus for sub menus to appear for selection, in less time. -----------------------------------------------------------------------------------------------------------------------------
    [Show full text]