After You, Please: Browser Extensions Order Attacks and Countermeasures
Total Page：16
File Type：pdf, Size：1020Kb
After You, Please: Browser Extensions Order Attacks and Countermeasures Pablo Picazo-Sanchez Juan Tapiador Chalmers j University of Gothenburg, Carlos III University Gothenburg, Sweden Madrid, Spain Gerardo Schneider Chalmers j University of Gothenburg, Gothenburg, Sweden Abstract ular browsers as of this writing (April 2018) are Chrome (77.9%), Firefox (11.8%), Internet Explor- Browser extensions are small applications executed er/Edge (4.1%), Safari (3.3%) and Opera (1.5%) in the browser context that provide additional capa- [18]. Most browsers allow users to install small bilities and enrich the user experience while surfing applications, generally developed by third parties, the web. The acceptance of extensions in current that provide additional functionality or enhance the browsers is unquestionable. For instance, Chrome’s user experience while browsing. Such plug-ins are official extension repository has more than 63,000 known as browser extensions and they interact with extensions, with some of them having more than the browser by sharing common resources such as 10M users. When installed, extensions are pushed tabs, cookies, HTML content or storage capabilities. into an internal queue within the browser. The or- der in which each extension executes depends on a In this paper we focus on Chromium [12], which number of factors, including their relative installa- is an open source browser and the basis for Chrome, tion times. In this paper, we demonstrate how this Opera, Comodo, Dragon and the Yandex browser. order can be exploited by an unprivileged malicious Extensions installed in Chromium can also run in all extension (i.e., one with no more permissions than mentioned browsers. The execution engine is ex- those already assigned when accessing web content) actly the same in all the browsers and follows the to get access to any private information that other same pipeline model that will be explained in some extensions have previously introduced. Our solution detail later (Section3). For this reason, we will re- does not require modifying the core browser engine fer to Chrome and Chromium interchangeably. Ex- as it is implemented as another browser extension. tensions in Chromium can be of three types: con- We prove that our approach effectively protects the tent scripts, background pages, or both. In what fol- user against usual attackers (i.e., any other installed lows, our main focus is on content scripts, which are extension) as well as against strong attackers having JavaScript files that run in the context of the loaded access to the effects of all installed extensions (i.e., web page. It is important to emphasize that the main knowing who did what). We also prove soundness aim of content scripts is to access and interact with arXiv:1908.02205v1 [cs.CR] 6 Aug 2019 and robustness of our approach under reasonable as- the Document Object Model (DOM). This fact alone sumptions. raises a fundamental privacy question, since it is ex- plicitly assumed that extensions will have full access to any (sensitive or not) content that the user is ac- 1 Introduction cessing. Browsers (including Chromium) dodge this issue by assuming that the user should trust the ex- Web browsers have become essential tools that are tension before installing it. In this paper we do not installed on nearly all computers. The most pop- address this problem, which is essentially related to 1 determining if an extension’s behavior is benign or E1 E2 E3 <latexit sha1_base64="VfYnBWr0qNp/vf1hBmmNQpZpI84=">AAAB5XicbZDNSsNAFIVv6l+tf1WXbgaL4KokIuiy6MZlBfsDbSiT6U0zdCYJMxOhhD6CrkTd+UK+gG/jpGahrWf1zT1n4J4bpIJr47pfTmVtfWNzq7pd29nd2z+oHx51dZIphh2WiET1A6pR8Bg7hhuB/VQhlYHAXjC9LfzeIyrNk/jBzFL0JZ3EPOSMmmI01Jkc1Rtu012IrIJXQgNKtUf1z+E4YZnE2DBBtR54bmr8nCrDmcB5bZhpTCmb0gkOLMZUovbzxa5zchYmipgIyeL9O5tTqfVMBjYjqYn0slcM//MGmQmv/ZzHaWYwZjZivTATxCSkqEzGXCEzYmaBMsXtloRFVFFm7GFqtr63XHYVuhdNz21695eN1k15iCqcwCmcgwdX0II7aEMHGETwDG/w7kycJ+fFef2JVpzyzzH8kfPxDR+Di+g=</latexit> malicious. X E1 HTML When analyzing the security and privacy impli- 1 HTML0 HTML0 E2 <latexit sha1_base64="VfYnBWr0qNp/vf1hBmmNQpZpI84=">AAAB5XicbZDNSsNAFIVv6l+tf1WXbgaL4KokIuiy6MZlBfsDbSiT6U0zdCYJMxOhhD6CrkTd+UK+gG/jpGahrWf1zT1n4J4bpIJr47pfTmVtfWNzq7pd29nd2z+oHx51dZIphh2WiET1A6pR8Bg7hhuB/VQhlYHAXjC9LfzeIyrNk/jBzFL0JZ3EPOSMmmI01Jkc1Rtu012IrIJXQgNKtUf1z+E4YZnE2DBBtR54bmr8nCrDmcB5bZhpTCmb0gkOLMZUovbzxa5zchYmipgIyeL9O5tTqfVMBjYjqYn0slcM//MGmQmv/ZzHaWYwZjZivTATxCSkqEzGXCEzYmaBMsXtloRFVFFm7GFqtr63XHYVuhdNz21695eN1k15iCqcwCmcgwdX0II7aEMHGETwDG/w7kycJ+fFef2JVpzyzzH8kfPxDR+Di+g=</latexit> cations of browser extensions, one question that 3 X HTML has been largely overlooked is the potential leak- E3 age of information among extensions. In nearly all HTML’ browsers, each content script uses its own wrapper of the DOM to read and make changes to the page Figure 1: Modified extension execution pipeline in loaded by the browser. They also run in a dedi- our solution. cated sandbox that the browser provides for security reasons. However, there is no isolation in terms of privacy, since all changes an extension performs in that ends up in the DOM, since it is assumed that its own DOM are automatically synchronized with other extensions could simply read or manipulate it. the main DOM. One straightforward—but nonethe- Even if browsers do not factor this into their threat less important—consequence of this is that a mali- model, we believe that this is a serious vulnerabil- cious extension could eavesdrop on other extensions ity that has not been discussed before. More im- (i.e., it can get access to the data they put on the portantly, it can be easily exploited by a malicious DOM and observe their actions) and even manipu- extension, regardless of the fact that it is explicitly late their behavior by acting on their DOM elements assumed in the browser’s extension model or not. (e.g., clicking on elements introduced by another ex- We discuss a vulnerability inherent to the way ex- tension). An attacker can exploit this using two dif- tensions are handled in Chromium, formalize this ferent strategies: problem in terms of knowledge gained by the at- 1. Exploiting the order. The way Chromium tacker and propose a solution that provides practical manages extensions (see Section3) introduces security isolation among extensions and does not re- a default execution order among extensions quire altering the core browser engine. The key idea with undesirable consequences. One key is- is to replace the extension pipeline by a (simulated) sue is that the n-th extension in the pipeline can parallel execution model in which all extensions re- learn all contents introduced by the first n − 1 ceive the same input page (see Fig.1). An addi- extensions in the HTML document. Thus, ex- tional component identifies the changes introduced tensions located at the end of the pipeline enjoy by each extension and applies all of them to the orig- more privacy than ones installed earlier. inal input page. We prove properties (soundness and 2. The order-independent attacks. Some of at- robustness) of our solution and also discuss limita- tacks enabled by the absence of effective isola- tions of this approach. tion among extensions’ actions do not require exploiting the execution order (i.e., getting the malicious extension to be placed at the end of 2 Chrome Browser Extensions the execution pipeline). However, exploiting the order provides the attacker with a privileged Events order in JavaScript. In JavaScript, the position that facilitates such attacks, which will event propagation mechanism determines in which result in a simpler code for the malicious exten- order an event is received by HTML elements. For sion that will increase the chances of passing instance, when two nested elements are subscribed the analysis performed by official stores [8]. to the same event and this event is fired, there are This lack of effective isolation is not only inher- basically two ways to propagate the event in the ent to Chromium’s extension model, but also explic- DOM: bubbling and capturing. By using capturing, itly acknowledged. Browsers such as Chrome do the event is initially handled by the root element and not even attempt to guarantee some form of “non- propagated to the its children. In contrast, with bub- interference” among extensions. On the contrary, bling the event is initially captured and handled by developers are encouraged to implement appropri- the children (leaves nodes in the DOM tree) and then ate mechanisms to protect any sensitive information propagated to their parents. 2 In JavaScript, extensions subscribe to events by manages tasks and microtasks. A task—a click using the addEvenListener() function. In our event, for instance—is run in its own thread and is example above we use capturing, so the first alert() composed of a set of JavaScript sentences, actions to will correspond to the <divid="1">. In case of handle the event, which belong to the event loop. All using bubbling, then the first alert() will corre- tasks are queued and executed sequentially. More- spond to the <divid="2"> element. over, when a setTimeout is used in the event Apart from the JavaScript event propagation loop, the callback function that is executed asyn- mechanism, extensions developers can define one chronously is queued as a new task. This is specially additional order level through a property named useful for monitoring delayed functions in browser run_at in the manifest.json file that allows extensions. them to control at which moment the extension will Nevertheless,