Real Javascript and Zero Side-Channel Attacks
Total Page：16
File Type：pdf, Size：1020Kb
JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks Michael Schwarz, Moritz Lipp and Daniel Gruss Graz University of Technology michael.schwarz,moritz.lipp,daniel.gruss @iaik.tugraz.at f g Abstract—Modern web browsers are ubiquitously used by sensors and features not present on commodity laptops and billions of users, connecting them to the world wide web. From the desktop computers. To make use of these additional features, other side, web browsers do not only provide a unified interface the World Wide Web Consortium (W3C) provides drafts and for businesses to reach customers, but they also provide a unified recommendations for additional APIs [53]. Examples include interface for malicious actors to reach users. The highly optimized the Geolocation API [49] and the Battery Status API [48]. scripting language JavaScript plays an important role in the These APIs are supported by most browsers and allow de- modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of velopers to build cross-platform web applications with similar the underlying hardware. In contrast to software bugs, there is functionality as native applications. often no easy fix for microarchitectural attacks. Undoubtedly, allowing every website to use such APIs has We propose JavaScript Zero, a highly practical and generic security and privacy implications. Websites can exploit sensors fine-grained permission model in JavaScript to reduce the attack to fingerprint the user [52] by determining the number of surface in modern browsers. JavaScript Zero facilitates advanced sensors, their update frequency, and also their value (e.g., for features of the JavaScript language to dynamically deflect usage battery level or geolocation). Furthermore, sensor data can be of dangerous JavaScript features. To implement JavaScript Zero in exploited to mount side-channel attacks on user input [7], [23]. practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, Microarchitectural attacks can also be implemented in and provide full compatibility with all websites. We demonstrate JavaScript, exploiting properties inherent to the design of the that our proof-of-concept browser extension Chrome Zero protects microarchitecture, such as timing differences in memory ac- against 11 unfixed state-of-the-art microarchitectural and side- cesses. Although JavaScript code runs in a sandbox, Oren et al. channel attacks. As a side effect, Chrome Zero also protects [33] demonstrated that it is possible to mount cache attacks against 50 % of the published JavaScript 0-day exploits since in JavaScript. Since their work, a series of microarchitectural Chrome 49. Chrome Zero has a performance overhead of 1.82% attacks have been mounted from websites, such as page on average. In a user study, we found that for 24 websites in deduplication attacks [14], Rowhammer attacks [15], ASLR the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has bypasses [13], and DRAM addressing attacks [40]. no perceivable effect on most websites. Hence, JavaScript Zero is As a response to these attacks, some—but not all—of the a practical solution to mitigate JavaScript-based state-of-the-art APIs have been restricted by reducing the resolution (e.g., High microarchitectural and side-channel attacks. Precision Time API) [2], [6], [9] or completely removing them (e.g., DeviceOrientation Event Specification) [51]. However, I. INTRODUCTION these countermeasures are incomplete as they do not cover all Over the past 20 years, JavaScript has evolved to the pre- sensors and are circumventable [13], [40]. dominant language on the web. Of the 10 million most popular A common trait of all attacks is that they rely on the websites, 94:7 % use JavaScript [54]. Dynamic content relies behavior of legitimate JavaScript features, which are rarely heavily on JavaScript, and thus, most pages use JavaScript required by benign web applications. However, removing these to improve the user experience, using, e.g., AJAX and dy- JavaScript features entirely breaks the compatibility with the namic page manipulation. Especially for platform-independent few websites that use them in a non-malicious way. This is, HTML5 applications, JavaScript is a vital component. for example, the case with NoScript, a browser extension that With the availability of modern browsers on mobile de- completely blocks JavaScript on a page [10]. vices, web applications target smartphones and tablets as well. We propose JavaScript Zero, a fine-grained JavaScript per- Furthermore, mobile platforms typically provide a number of mission system, which combines ideas from existing permis- sion systems in browsers and smartphone operating systems. JavaScript Zero facilitates advanced features of the JavaScript language to overcome the following three challenges: C1 Restrictions must not be circumventable using self- modifying code, such as higher-order scripts. Network and Distributed Systems Security (NDSS) Symposium 2018 C2 Restricting access to potentially dangerous features must 18-21 February 2018, San Diego, CA, USA ISBN 1-891562-49-5 be irreversible for a website. http://dx.doi.org/10.14722/ndss.2018.23094 C3 Restrictions must not have a significant impact on com- www.ndss-symposium.org patibility and user experience. To overcome challenge C1, we utilize advanced language 4) We evaluate our proof-of-concept implementation Chrome features such as virtual machine layering [19] for security. In Zero in terms of performance and usability. Chrome Zero contrast to previous approaches [56], virtual machine layer- has 1:82 % performance overhead on average on the ing allows redefining any function of the JavaScript virtual Alexa Top 10 websites. In a double-blind user study, we machine at runtime. Hence, we can cope with obfuscated show that users cannot distinguish a browser with and code and higher-order scripts, i.e., scripts that generate scripts. without Chrome Zero for 24 of the Alexa Top 25 websites. JavaScript Zero replaces all potentially dangerous functions The remainder of the paper is organized as follows. Sec- with secure wrappers. When calling such a function, JavaScript tion II provides preliminary information necessary to under- Zero decides whether to perform a pre-defined action or ask stand the defenses we propose. Section III defines the threat the user for permission to execute the function. model. Section IV describes the design of JavaScript Zero. To overcome challenge C2, we utilize closures, another Section V details our proof-of-concept implementation Chrome advanced feature of the JavaScript language, for security. Zero. Section VI provides a security analysis of Chrome Zero Variables in closures cannot be accessed from any outside as an instance of JavaScript Zero. Section VII provides a scope, providing us with language-level protection for our usability analysis of Chrome Zero. Section VIII discusses countermeasure. With closures, we make all references to related work. We conclude our work in Section IX. original unprotected functions inaccessible to the website. We provide a proof-of-concept implementation as a II. PRELIMINARIES Chrome browser extension, Chrome Zero. In contrast to pre- In this section, we provide preliminary information on vious protection techniques [24], [18], Chrome Zero requires microarchitectural attacks in native code and JavaScript, and no changes to the browser source code. Hence, Chrome Zero on JavaScript exploits. requires lower maintenance efforts while at the same time users also benefit from the security of the most up-to-date browser. A. Microarchitectural Attacks To overcome challenge C3, we keep user interactions Modern processors are highly optimized for computational to a minimum and provide multiple protection levels with power and efficiency. However, optimizations often intro- pre-defined restrictions. We do not only provide a binary duce side effects that can be exploited in so-called microar- permission system to block or allow certain functionality, but chitectural attacks. Microarchitectural attacks comprise side- we also allow to modify the semantics of functions and objects. channel and fault attacks on microarchitectural elements or For example, the user can allow the usage of the high-precision utilizing microarchitectural elements, e.g., pipelines, caches, timing API but decides to reduce the available resolution to buses, DRAM. Attacks on caches have been investigated 100 ms instead of 5 µs. These settings can be configured by extensively in the past 20 years, with a focus on cryptographic either the user or the community, through a protection list. implementations [17], [4]. The timing difference between a We evaluate the efficacy of Chrome Zero on 23 recent side- cache hit and a cache miss can be exploited to learn secret channel attacks, microarchitectural attacks, and 0-day exploits. information from co-located processes and virtual machines. We show that it successfully prevents all microarchitectural Modern attacks use either Flush+Reload [55], if read-only and side-channel attacks in JavaScript. Although not a main shared memory is available, or Prime+Probe [34] otherwise. goal of Chrome Zero, it also prevents 50 % of the published In both attacks, the attacker manipulates the state of the cache JavaScript 0-day exploits since Chrome 49. This shows that and later on checks whether the