Diplomarbeit A Secure Architecture for Untrusted Web Browser Plugins Achim Weimert 9.März 2011 Technische Universität Berlin Fakultät IV Institut für Softwaretechnik und Theoretische Informatik Professur Security in Telecommunications Betreuender Hochschullehrer: Prof. Dr. Jean-Pierre Seifert Betreuender Mitarbeiter: Dipl.-Inf. Matthias Lange Erklärung Die selbständige und eigenhändige Ausfertigung versichert an Eides statt Berlin, den Achim Weimert Contents 1 Introduction 1 2 Background 5 2.1 Sandboxing . .5 2.2 Dynamic Content . .6 2.2.1 Client-Side Programming Support . .6 2.3 Plugins . .8 2.3.1 Plugin Interfaces . .8 2.3.1.1 Netscape Plugin API . .9 2.3.1.2 Pepper Plugin API . 11 2.3.1.3 MozPlugger . 11 2.3.2 Important Plugins . 12 2.3.2.1 Adobe Flash Player . 12 2.3.2.2 Java Applets . 12 2.3.2.3 Microsoft Silverlight . 13 2.4 Content Handling in Browsers . 13 2.5 Browser Architecture . 14 2.5.1 Browser Extensions . 15 2.5.2 Multi-process Architectures . 15 2.6 Threat Analysis . 17 2.6.1 Attacking Web Browser Availability . 17 2.6.2 Unrestricted File System Access . 17 2.6.3 Unrestricted Network Access . 18 2.6.4 User Interface Forgery . 19 2.6.5 Attacking Web Browser Integrity . 20 2.6.6 Summary . 21 2.6.7 Threat Model and Assumptions . 22 3 Design 25 3.1 Designing a Secure Plugin API . 25 3.2 Execution Model . 26 3.2.1 Threading Model . 27 3.2.2 Event Model Using Callbacks . 27 3.2.3 Virtual CPU Model . 27 3.3 Information Flow . 28 3.3.1 vCPU System Calls . 28 3.3.2 Event Handling . 29 V Contents 3.3.3 Handling of Pending Events . 30 3.3.4 Handling of Data Events . 31 3.3.5 Host Main Loop . 32 3.4 Scheduling . 32 3.5 Synchronization . 34 3.5.1 Thread-Synchronization with Upcalls . 34 3.5.2 Thread-Synchronization with other Threads . 34 3.5.3 Thread-Synchronization with Upcalls and other Threads . 34 4 Implementation 37 4.1 vCPU . 37 4.1.1 Sandboxing Using ptrace ...................... 37 4.1.2 Setup of Host-Client Interaction . 38 4.1.3 Event Handling . 39 4.1.4 Host Main Loop . 39 4.1.5 vCPU System Calls . 40 4.1.5.1 vCPU System Call Execution . 40 4.1.5.2 vCPU System Call Types . 40 4.1.6 Race Conditions Between Events and System Calls . 41 4.1.7 User Level Resume . 42 4.2 Threading Library . 45 4.2.1 Scheduling . 45 4.2.2 Synchronization . 46 4.2.2.1 Mutex . 46 4.2.2.2 Condition Variable . 47 4.2.2.3 Semaphore . 48 4.2.3 Client Prioritization of Data Events . 49 4.2.4 Dynamic Memory Allocation . 49 4.3 Example Execution . 50 4.4 Video Playback Using Plugin . 51 5 Evaluation 55 5.1 System Call Roundtrip . 55 5.2 Context Switch . 55 5.3 Comparing User-level Resume with syscall_resume ........... 56 5.4 Event Latency . 57 5.5 Data Event Latency . 58 5.5.1 Influence of Thread Priorities on Latency . 59 5.5.2 Influence of Event Buffer Size on Latency . 60 5.6 Computation Overhead . 61 5.7 Data Throughput . 62 5.8 Video Playback Using Plugin . 63 6 Related Work 67 6.1 Browsers . 67 VI Contents 6.1.1 Transparently Securing Plugins in Internet Explorer . 67 6.1.2 Chromium Sandbox . 67 6.1.3 Google Native Client . 68 6.1.4 OP Web Browser . 69 6.1.5 Microsoft Gazelle . 69 6.2 Operating Systems . 70 6.2.1 Chromium OS . 70 6.2.2 Illinios Browser Operating System . 71 6.2.3 Capsicum . 71 7 Conclusion 73 7.1 Outlook . 73 7.2 Future Work . 73 A Summary (German) 77 Glossary 79 Bibliography 81 VII List of Figures 2.1 A NPAPI plugin’s lifecycle. 10 2.2 Architecture and dependencies of modern web browsers . 15 2.3 Screenshot of a plugin reading the local file system. 18 2.4 Screenshot of a plugin reading the file /etc/passwd............ 19 2.5 Screenshot taken before detouring the function gettimeofday...... 20 2.6 Screenshot taken after detouring the function gettimeofday....... 21 2.7 Threat Model . 22 4.1 vCPU host and client interaction . 42 4.2 vCPU execution example . 52 5.1 Event latency with computational threads . 58 5.2 Event latency with data handling threads . 59 5.3 Latency distribution . 60 5.4 Data event latency with computational threads . 61 5.5 Data event latency with data handling threads . 62 5.6 Latency dependence on buffer size . 63 5.7 Delivery time dependence on buffer size . 64 5.8 Data throughput . 65 IX List of Tables 5.1 Time consumption of system calls . 55 5.2 Time consumption of context switches . 56 5.3 Time consumption of user-level resume and syscall_resume ...... 57 5.4 Event latency . 57 5.5 Computation overhead . 61 5.6 Data throughput . 62 5.7 Video decoding performance . 64 XI 1 Introduction The Internet has changed the way people access information and communicate. At its beginning, it was mainly used for connecting remote mainframes. For example, a computer with high computing capabilities could provide its processing capacity to remote researchers. Other usages include the transmission of larger amounts of data (e.g. using FTP software) as well as communication within specific groups based on email or within larger groups based on Usenet. A structured way of retrieving information was available in the form of Gopher, which was designed to present text documents in a hierarchical manner. In the 1990s, the world wide web emerged as interlinked web pages which are delivered over the Internet. At that time, the first web browsers and web pages were developed to solve the problem of referencing, retrieving and displaying documents. Web pages mainly consisted of formatted text and hyperlinks as defined by the markup language HTML. Describing a web page, HTML was rendered and displayed by the browser. Using hyperlinks, different web pages could reference each other, giving the user a mean to easily navigate from one web page to the next one. This new way of accessing documents quickly became popular and information was increasingly being published using web pages. At that time, user interaction could only be reflected in a web page by navigating to a new web page. The user experience would benefit from a more dynamic interaction mode. To that end, the static nature of early HTML was not suitable. First trials on replacing traditional applications with websites were being made, for the development of websites featuring rich user interfaces and complex user interactions, programming support was found necessary. For example, due to the missing support for programming inside web pages, dynamic web applications like email or chat clients were not possi- ble. Consequently, limited programming support for interpreted scripting languages was added to browsers in the form of JavaScript and VBScript. Using those scripting languages, web pages and their elements could dynamically be modified. Comparing favorably with refetching of a web page, scripting support greatly improved the possi- bilities for dynamic web pages. Being supported by many browsers, JavaScript gradually pushed back VBScript and became widely used on web pages. Browsers at that time were missing support for multimedia content like video play- back or rich document (e.g. Portable Document Format - PDF) and advanced graphic formats (e.g. Scalable Vector Graphics - SVG). Whenever the user navigated to such a resource, the browser offered to download the file. After the download was completed the user could open the file using a locally installed application. As the user experience would improve by dispensing the additional steps and displaying commonly used content types inside the browser, the inclusion of complex documents evolved as a new require- ment. For different reasons, support for those documents could not be added using the available scripting languages. For example, being an interpreted language, JavaScript 1 1 Introduction performance was not suitable for the calculations involved in video decoding. Addition- ally, as JavaScript is executed in a limited runtime environment, hardware acceleration for rendering complex graphics was not available. Support for compiled programming languages could have been added. As a result, the browser would download the source code,.