Tracing for Web 3.0 Trace Compilation for the Next Generation Web Applications

Total Page:16

File Type:pdf, Size:1020Kb

Tracing for Web 3.0 Trace Compilation for the Next Generation Web Applications Tracing for Web 3.0 Trace Compilation for the Next Generation Web Applications Mason Changy∗, Edwin Smith∗, Rick Reitmaier∗, Michael Bebenitay, Andreas Galyx, Christian Wimmery, Brendan Eichx, Michael Franzy ∗Adobe Corporation yUniversity of California, Irvine xMozilla Corporation fedwsmith,[email protected], fchangm,mbebenit,gal,cwimmer,[email protected], [email protected] Abstract applications become more sophisticated, they rely more and more Today’s web applications are pushing the limits of modern web on JavaScript to do the heavy lifting rather than just using it for triv- browsers. The emergence of the browser as the platform of choice ial scripting tasks. As a result, JavaScript performance has become for rich client-side applications has shifted the use of in-browser a real bottleneck to the web experience. JavaScript from small scripting programs to large computationally The flexibility and rapid prototyping abilities of dynamically intensive application logic. For many web applications, JavaScript typed languages such as JavaScript are the main factors contribut- performance has become one of the bottlenecks preventing the ing to their popularity on the web. Today’s web applications are development of even more interactive client side applications. built using an array of largely independent technologies such as While traditional just-in-time compilation is successful for stati- HTML, CSS, XML, and SQL. Making these technologies work cally typed virtual machine based languages like Java, compiling together requires a flexible and dynamically typed language. Un- JavaScript turns out to be a challenging task. Many JavaScript fortunately, flexibility comes at a cost. The performance of dynam- programs and scripts are short-lived, and users expect a responsive ically typed languages has long been many orders of magnitude browser during page loading. This leaves little time for compilation lower than their statically typed counterparts. Poor JavaScript per- of JavaScript to generate machine code. formance is a severe limitation for web applications. We present a trace-based just-in-time compiler for JavaScript Due to their highly dynamic structure, dynamically typed lan- that uses run-time profiling to identify frequently executed code guages are poor candidates for just-in-time compilation. For this paths, which are compiled to executable machine code. Our ap- reason, most dynamically typed language runtimes instead rely on proach increases execution performance by up to 116% by decom- interpretation as their primary means of execution. We introduce posing complex JavaScript instructions into a simple Forth-based Tamarin-Tracing, a new JavaScript virtual machine that aims to representation, and then recording the actually executed code path break the poor performance barrier. Our approach is to make just- through this low-level IR. Giving developers more computational in-time (JIT) compilation effective in a dynamically typed language horsepower enables a new generation of innovative web applica- runtime environment. We accomplish this by using a novel trace- tions. based compilation technique [13], which is effective in eliminating many of the problems that arise when building traditional JIT com- Categories and Subject Descriptors D.3.4 [Programming Lan- pilers for dynamically typed languages. Our trace-based compiler guages]: Processors - Compilers selects and compiles only frequently executed “hot” code paths, while interpreting rarely executed code. Moreover, the code se- General Terms Design, Languages, Performance lected for compilation can be type specialized according to the type Keywords JavaScript, Trace Trees, Tracing, Forth, Type Special- profile of the running application, allowing our compiler to make ization, Tamarin, Dynamic Compilation, Dynamically Typed Lan- aggressive type driven optimizations. This makes it possible for us guages to remove much of the principal overhead of the dynamically typed JavaScript language, compiling untyped code as typed code. 1. Introduction We compare Tamarin-Central, a conventional compiler used in the current virtual machine shipping with Adobe Flash 9, with The web has become an ubiquitous platform for content-rich appli- Tamarin-Tracing, a trace-based just-in-time compiler. We found cations. In the early days of “Web 1.0”, most web sites were fairly that Tamarin-Tracing outperforms Tamarin-Central by up to 116%. static and provided little user interaction. The “Web 2.0” revolu- Our experience with Tamarin-Tracing allows us to make the fol- tion redefined the browser as a vehicle for delivering richer media lowing contributions: content and interactivity through a fusion of existing technologies, most notably Asynchronous JavaScript and XML (AJAX). As web 1. We present a trace-based just-in-time compiler for JavaScript. 2. We compare our compiler against other production JavaScript c ACM, 2009. This is the author’s version of the work. It is posted here by permission runtimes. of ACM for your personal use. Not for redistribution. The definitive version was published in the Proceedings of the International Conference on Virtual Execution 3. We investigate type specialization on traces. Environments, pp. 71–80. VEE’09, March 11–13, 2009, Washington, DC, USA. 4. We show the performance implications of using complex vs. http://doi.acm.org/10.1145/1508293.1508304 simple opcodes. 71 2. Tamarin minimum. A fast interpreter is also essential in the case of a snippet Tamarin is the code name used for Adobe’s virtual machines that of JavaScript code that runs for only a few milliseconds. The implement ActionScript 3 (AS3) [1], a flavor of ECMAScript [11]. argument that a slow interpreter is acceptable is no longer valid JavaScript is also a flavor of ECMAScript, however AS3 supports on the web. multiple constructs that JavaScript does not, such as optional static The poor performance of interpreters is largely due to the high typing, packages, classes, and early binding. AS3 has a syntax that cost of opcode dispatch. Each opcode dispatch is at a minimum one is similar to JavaScript, and most JavaScript can be executed on indirect branch, which often introduces processor pipeline stalls. Tamarin without any modification. Tamarin does not directly op- The complexity of individual instructions is largely dwarfed by the erate on AS3 source code, but instead executes a bytecode inter- high dispatch overhead. A “simple” opcode has a fine granularity mediate format known as ActionScript bytecode (ABC) [2]. Con- yet higher dispatch overhead. A “complex” opcode has a coarse ceptually, this is the equivalent of the Java Virtual Machine Lan- granularity with the advantage of low dispatch cost. For this rea- guage (JVML) bytecode [19]. ActionScript bytecode, like JVML son, a common interpreter optimization is to group single simple bytecode, is a stack based intermediate representation. ActionScript opcodes into larger complex opcodes. This reduces the number of source files are converted to ActionScript bytecode using the Adobe dispatches at the expense of opcode complexity, which can lead Flex compiler [3]. to better interpreter performance. Forth is able to mend itself well There are currently two development branches of Tamarin: to varying levels of opcode granularity. During interpretation, the Tamarin-Central (TC) and Tamarin-Tracing (TT). Tamarin-Central coarse granularity of Super Words can reduce opcode dispatch cost, is the current virtual machine shipping with Adobe Flash 9, while while during trace recording the compiler is able to reduce the Su- Tamarin-Tracing is a research virtual machine slated for future ver- per Words to finer grained primitive words. sions of Adobe Flash. Tamarin-Central uses a conventional inter- preter and JIT compiler, while Tamarin-Tracing leverages a trace- 4. Forth based compiler to achieve performance improvements. Tamarin- Forth operates on two stacks: the data stack and the return stack. Tracing is partially a self-hosting compiler, with many portions of The data stack is used for arithmetic operations, while the return the system itself written in ActionScript 3. Tamarin-Tracing uses stack is used for control flow operations. Consider the sample Forth the Forth language as an intermediate representation. Before Ac- code: tionScript source can be executed, it is first compiled to ABC and 10 20 + . then translated to Forth. Tamarin-Tracing is essentially a Forth vir- This Forth code sequence pushes the numbers 10 and 20 onto tual machine. the data stack. These numbers are then popped off the data stack, Forth is a stack-based programming language that uses reverse added, and their sum is then pushed back onto the stack. The “.” Polish notation and operates on subroutines known as Words. Con- Forth word prints the result onto the screen. ceptually, programming in Forth is similar to programming in Forth was chosen as an intermediate language due to the lan- JVML, each Forth word behaving like a JVML bytecode. Tamarin guage’s ease in refactoring and resulting code size. Forth contains contains roughly 200 Primitive Words, which implement the basic a small number of primitive words, such as add. New words are operations such as performing arithmetic or stack manipulation. In constructed by concatenating previous words. Word definitions do Forth, words known as Super Words can be constructed by combin- not take parameters, and instead operate on either the data or re- ing other Primitive Words. For example, consider the JVML iinc turn stack without any explicit
Recommended publications
  • Differential Fuzzing the Webassembly
    Master’s Programme in Security and Cloud Computing Differential Fuzzing the WebAssembly Master’s Thesis Gilang Mentari Hamidy MASTER’S THESIS Aalto University - EURECOM MASTER’STHESIS 2020 Differential Fuzzing the WebAssembly Fuzzing Différentiel le WebAssembly Gilang Mentari Hamidy This thesis is a public document and does not contain any confidential information. Cette thèse est un document public et ne contient aucun information confidentielle. Thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Technology. Antibes, 27 July 2020 Supervisor: Prof. Davide Balzarotti, EURECOM Co-Supervisor: Prof. Jan-Erik Ekberg, Aalto University Copyright © 2020 Gilang Mentari Hamidy Aalto University - School of Science EURECOM Master’s Programme in Security and Cloud Computing Abstract Author Gilang Mentari Hamidy Title Differential Fuzzing the WebAssembly School School of Science Degree programme Master of Science Major Security and Cloud Computing (SECCLO) Code SCI3084 Supervisor Prof. Davide Balzarotti, EURECOM Prof. Jan-Erik Ekberg, Aalto University Level Master’s thesis Date 27 July 2020 Pages 133 Language English Abstract WebAssembly, colloquially known as Wasm, is a specification for an intermediate representation that is suitable for the web environment, particularly in the client-side. It provides a machine abstraction and hardware-agnostic instruction sets, where a high-level programming language can target the compilation to the Wasm instead of specific hardware architecture. The JavaScript engine implements the Wasm specification and recompiles the Wasm instruction to the target machine instruction where the program is executed. Technically, Wasm is similar to a popular virtual machine bytecode, such as Java Virtual Machine (JVM) or Microsoft Intermediate Language (MSIL).
    [Show full text]
  • Rich Media Web Application Development I Week 1 Developing Rich Media Apps Today’S Topics
    IGME-330 Rich Media Web Application Development I Week 1 Developing Rich Media Apps Today’s topics • Tools we’ll use – what’s the IDE we’ll be using? (hint: none) • This class is about “Rich Media” – we’ll need a “Rich client” – what’s that? • Rich media Plug-ins v. Native browser support for rich media • Who’s in charge of the HTML5 browser API? (hint: no one!) • Where did HTML5 come from? • What are the capabilities of an HTML5 browser? • Browser layout engines • JavaScript Engines Tools we’ll use • Browsers: • Google Chrome - assignments will be graded on Chrome • Safari • Firefox • Text Editor of your choice – no IDE necessary • Adobe Brackets (available in the labs) • Notepad++ on Windows (available in the labs) • BBEdit or TextWrangler on Mac • Others: Atom, Sublime • Documentation: • https://developer.mozilla.org/en-US/docs/Web/API/Document_Object_Model • https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API/Tutorial • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide What is a “Rich Client” • A traditional “web 1.0” application needs to refresh the entire page if there is even the smallest change to it. • A “rich client” application can update just part of the page without having to reload the entire page. This makes it act like a desktop application - see Gmail, Flickr, Facebook, ... Rich Client programming in a web browser • Two choices: • Use a plug-in like Flash, Silverlight, Java, or ActiveX • Use the built-in JavaScript functionality of modern web browsers to access the native DOM (Document Object Model) of HTML5 compliant web browsers.
    [Show full text]
  • Flash Player and Linux
    Flash Player and Linux Ed Costello Engineering Manager Adobe Flash Player Tinic Uro Sr. Software Engineer Adobe Flash Player 2007 Adobe Systems Incorporated. All Rights Reserved. Overview . History and Evolution of Flash Player . Flash Player 9 and Linux . On the Horizon 2 2007 Adobe Systems Incorporated. All Rights Reserved. Flash on the Web: Yesterday 3 2006 Adobe Systems Incorporated. All Rights Reserved. Flash on the Web: Today 4 2006 Adobe Systems Incorporated. All Rights Reserved. A Brief History of Flash Player Flash Flash Flash Flash Linux Player 5 Player 6 Player 7 Player 9 Feb 2001 Dec 2002 May 2004 Jan 2007 Win/ Flash Flash Flash Flash Flash Flash Flash Mac Player 3 Player 4 Player 5 Player 6 Player 7 Player 8 Player 9 Sep 1998 Jun 1999 Aug 2000 Mar 2002 Sep 2003 Aug 2005 Jun 2006 … Vector Animation Interactivity “RIAs” Developers Expressive Performance & Video & Standards Simple Actions, ActionScript Components, ActionScript Filters, ActionScript 3.0, Movie Clips, 1.0 Video (H.263) 2.0 Blend Modes, New virtual Motion Tween, (ECMAScript High-!delity machine MP3 ed. 3), text, Streaming Video (ON2) video 5 2007 Adobe Systems Incorporated. All Rights Reserved. Widest Reach . Ubiquitous, cross-platform, rich media and rich internet application runtime . Installed on 98% of internet- connected desktops1 . Consistently reaches 80% penetration within 12 months of release2 . Flash Player 9 reached 80%+ penetration in <9 months . YUM-savvy updater to support rapid/consistent Linux penetration 1. Source: Millward-Brown September 2006. Mature Market data. 2. Source: NPD plug-in penetration study 6 2007 Adobe Systems Incorporated. All Rights Reserved.
    [Show full text]
  • Actionscript 3.0 from the Ground up Tour
    Adobe Presents Colin Moock’s ActionScript 3.0 From the Ground Up Tour Materials provided by O’Reilly Media, Inc. Welcome Key Learning Welcome to the ActionScript 3.0: From the Ground Up Tour! In collaboration with Colin Moock, FITC Design and Technology The following table lists some of today’s most important concepts. Events, O’Reilly, and participating academic institutions around the world, Adobe is thrilled to bring you this world-class day of training. Following the tradition of Flex Camp (http://flex.org/camp/) and the onAIR bus tour (http://onair.adobe.com/), this Concept Example lecture is an important part of Adobe’s ongoing initiative to bring knowledge to the development community. Classes are blueprints for objects. class VirtualPet { At Adobe, we understand that a tool is only useful when you know how to use it. And we’re committed to helping you gain that knowledge. So sit back, get ready for a high-paced day of learning, and most of all have fun! } Objects (or instances) are the things in a program, new VirtualPet() Links and Resources such as a number, a car, a button, a point in time The entire set of notes for today’s lecture are available at: Some classes are built into ActionScript, others are MovieClip, TextField, Sound, String custom-made. http://moock.org/lectures/groundUpAS3 A package contains a class so its name doesn’t package zoo { The code for the virtual zoo application can be obtained at: conflict with other names. class VirtualPet { http://moock.org/eas3/examples/moock_eas3_examples/virtualzoo_final } For a prose version of today’s lecture in book form, see Colin Moock’s Essential ActionScript 3.0 (O’Reilly, 2007).
    [Show full text]
  • Behavioural Analysis of Tracing JIT Compiler Embedded in the Methodical Accelerator Design Software
    Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica Tesi di laurea magistrale in Calcolatori Elettronici II Behavioural Analysis of Tracing JIT Compiler Embedded in the Methodical Accelerator Design Software Anno Accademico 2018/2019 CERN-THESIS-2019-152 //2019 relatori Ch.mo prof. Nicola Mazzocca Ch.mo prof. Pasquale Arpaia correlatore Ing. Laurent Deniau PhD candidato Dario d’Andrea matr. M63000695 Acknowledgements Firstly, I would like to thank my supervisor at CERN, Laurent Deniau, for his daily support and his useful suggestions throughout the work described in this thesis. I would like to express my gratitude to both my university supervisors, Nicola Mazzocca and Pasquale Arpaia, for their helpfulness during this work and for their support during the past years at university. I feel privileged of being allowed to work with such inspiring mentors. This thesis would not have been possible without the help from the community of the LuaJIT project including all the useful insights contained in its mailing list, specially by its author, Mike Pall, who worked for many years accomplishing an amazing job. A special acknowledgement should be addressed to my family. I thank my father Guido and my mother Leda who guided me with love during my education and my life. I am grateful to my brother Fabio, my grandmother Tina, and my uncle Nicola, for their support during the past years. I also want to remember my uncle Bruno who inspired me for my academic career. I wish to express my deepest gratitude to Alicia for her unconditional encour- agement.
    [Show full text]
  • Optimizing Actionscript Bytecode Using LLVM
    Optimizing ActionScript Bytecode using Replace with LLVM a graphic White Master 5.5” Tall & 4.3” Wide 10/2/2009 Scott Petersen Adobe Systems, Inc. Copyright 2009 Adobe Systems Incorporated. All rights reserved. Adobe confidential. 1 ActionScript 3 . Adobe Flash/AIR app development language . EcmaScript based – “JavaScript with classes and types” . var x; // implicitly a variant – JS style . var x:int; // x is an int! . var x:*; // explicitly a variant . ActionScript Bytecode (ABC) reminiscent of JVM bytecode . Verified . Stack oriented . Object oriented ® Copyright 2009 Adobe Systems Incorporated. All rights reserved. Adobe confidential. 2 ActionScript 3 . JIT compiler + interpreter + garbage collector + basic support library in around 1.5M uncompressed, 600k compressed for x86 . Open Source Tamarin Project http://www.mozilla.org/projects/tamarin . Straightforward AS3 compiler . Effectively non-optimizing ® Copyright 2009 Adobe Systems Incorporated. All rights reserved. Adobe confidential. 3 ActionScript 3 Performance . Performance for AS => AS3 compiler + Tamarin JIT . Roughly 1.2% of native optimized C (Scimark2 numeric benchmark) . Performance for C => C/LLVM based frontend (Alchemy) + Tamarin JIT . Roughly 30% of native optimized C (Scimark2 numeric benchmark) . Performance for Java => javac + JRE 6 . Roughly 60% of native optimized C (Scimark2 numeric benchmark) ® Copyright 2009 Adobe Systems Incorporated. All rights reserved. Adobe confidential. 4 ActionScript 3 Performance . C code running on the Tamarin JIT is >20x faster than AS3! . Why is C code so fast on Tamarin? . Why is AS3 code so slow on Tamarin? . Alchemy generated code . Avoids some known performance pitfalls in Tamarin . AS3 has a variant type – boxing and unboxing is expensive – Alchemy avoids this . AS3 often does many object allocations, taxing the GC – Alchemy uses a single “ram” object with fast access opcodes .
    [Show full text]
  • Mozilla Source Tree Docs Release 50.0A1
    Mozilla Source Tree Docs Release 50.0a1 August 02, 2016 Contents 1 SSL Error Reporting 1 2 Firefox 3 3 Telemetry Experiments 11 4 Build System 17 5 WebIDL 83 6 Graphics 85 7 Firefox for Android 87 8 Indices and tables 99 9 Localization 101 10 mach 105 11 CloudSync 113 12 TaskCluster Task-Graph Generation 119 13 Crash Manager 133 14 Telemetry 137 15 Crash Reporter 207 16 Supbrocess Module 211 17 Toolkit modules 215 18 Add-on Manager 221 19 Linting 227 20 Indices and tables 233 21 Mozilla ESLint Plugin 235 i 22 Python Packages 239 23 Managing Documentation 375 24 Indices and tables 377 Python Module Index 379 ii CHAPTER 1 SSL Error Reporting With the introduction of HPKP, it becomes useful to be able to capture data on pin violations. SSL Error Reporting is an opt-in mechanism to allow users to send data on such violations to mozilla. 1.1 Payload Format An example report: { "hostname":"example.com", "port":443, "timestamp":1413490449, "errorCode":-16384, "failedCertChain":[ ], "userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0", "version":1, "build":"20141022164419", "product":"Firefox", "channel":"default" } Where the data represents the following: “hostname” The name of the host the connection was being made to. “port” The TCP port the connection was being made to. “timestamp” The (local) time at which the report was generated. Seconds since 1 Jan 1970, UTC. “errorCode” The error code. This is the error code from certificate veri- fication. Here’s a small list of the most commonly-encountered errors: https://wiki.mozilla.org/SecurityEngineering/x509Certs#Error_Codes_in_Firefox In theory many of the errors from sslerr.h, secerr.h, and pkixnss.h could be encountered.
    [Show full text]
  • Tion Thomas EA Graphics Lunch Presentation
    Tion Thomas EA Graphics Lunch Presentation Software Engineering Intern Central Technology Group – Apt Purdue University – MS ‘09 Mentor: Anand Kelkar Manager: Fazeel Gareeboo EA Company Overview Founded in 1982 Largest 3rd party game publisher in the world Net revenue of $3.67 billion in FY 2008 #1 mobile game publisher (acquired JAMDAT) Multi-Platform philosophy Has/owns development studios all over the globe: Bioware/Pandemic (Bioshock, Mercenaries) Criterion (Burnout, Black) Digital Illusions (Battlefield series) Tiburon (Madden) Valve (Half-Life) Crytek (Crysis) EA Company Overview cont… 4 Major Brands/Divisions: EA Sports (FIFA, Madden, NBA, NFL, Tiger Woods, NASCAR) EA Sports Freestyle (NBA Street, NFL Street, FIFA Street, SSX) EA (Medal of Honor, C&C, Need For Speed, SIMS, Spore, Dead Space) POGO (Casual web based games) Currently has 4 entries on the top selling franchises of all time list: #3 - Sims (100 million) #5 - Need For Speed (80 million) #7 – Madden (70 million) #9 - FIFA (65 million) EA Is Unique Sheer size breaks the traditional game developer paradigm Bound by multi-platform technology Long history with titles on almost every console that ever existed Most studios have annual cycles that cannot be broken Both developer and publisher with ownership in many huge studios Origin Of Tiburon Founded by 3 programmers in Longwood, FL First title was MechWarrior for SNES First Madden title was Madden 96 for Genesis, SNES Acquired by EA in 1998 How Tiburon Got Madden Originally, EA contracted Visual
    [Show full text]
  • Comparing Javascript Engines
    Comparing Javascript Engines Xiang Pan, Shaker Islam, Connor Schnaith Background: Drive-by Downloads 1. Visiting a malicious website 2. Executing malicious javascript 3. Spraying the heap 4. Exploiting a certain vulnerability 5. Downloading malware 6. Executing malware Background: Drive-by Downloads 1. Visiting a malicious website 2. Executing malicious javascript 3. Spraying the heap 4. Exploiting a certain vulnerability 5. Downloading malware 6. Executing malware Background: Drive-by Downloads Background: Drive-by Downloads Setup: Making the prototype null while in the prototype creates a pointer to something random in the heap. Background: Drive-by Downloads Environment: gc( ) is a function call specific to Firefox, so the attacker would want to spray the heap with an exploit specific to firefox. Background: Drive-by Downloads Obfuscation: If the browser executing the javascript it firefox,the code will proceed to the return statement. Any other browser will exit with an error due to an unrecognized call to gc( ). Background: Drive-by Downloads Download: The return will be to a random location in the heap and due to heap-spraying it will cause shell code to be executed. Background: Goal of Our Project ● The goal is to decode obfuscated scripts by triggering javascript events ● The problem is when triggering events, some errors, resulting from disparity of different engines or some other reasons, may occur and terminate the progress ● We need to find ways to eliminate the errors and Ex 1therefore generate more de-obfuscated scripts <script> function f(){ //some codes gc(); var x=unescape(‘%u4149%u1982%u90 […]’)); eval(x); } </script> Ex 2 <script type="text/javascript" src="/includes/jquery/jquery.js"></script> Project Overview - Part One ● Modify WebKit engine so that it can generate error informations.
    [Show full text]
  • VULNERABLE by DESIGN: MITIGATING DESIGN FLAWS in HARDWARE and SOFTWARE Konoth, R.K
    VU Research Portal VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE Konoth, R.K. 2020 document version Publisher's PDF, also known as Version of record Link to publication in VU Research Portal citation for published version (APA) Konoth, R. K. (2020). VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [email protected] Download date: 07. Oct. 2021 VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE PH.D. THESIS RADHESH KRISHNAN KONOTH VRIJE UNIVERSITEIT AMSTERDAM, 2020 Faculty of Science The research reported in this dissertation was conducted at the Faculty of Science — at the Department of Computer Science — of the Vrije Universiteit Amsterdam This work was supported by the MALPAY consortium, consisting of the Dutch national police, ING, ABN AMRO, Rabobank, Fox-IT, and TNO.
    [Show full text]
  • Understanding and Mitigating Attacks Targeting Web Browsers
    Understanding and Mitigating Attacks Targeting Web Browsers A Dissertation presented in partial fulfillment of the requirements for the degree of Doctor of Philosophy in the field of Information Assurance by Ahmet Salih Buyukkayhan Northeastern University Khoury College of Computer Sciences Boston, Massachusetts April 2019 To my family, teachers and mentors. i Contents List of Figures v List of Tables vii Acknowledgments viii Abstract of the Dissertation ix 1 Introduction 1 1.1 Structure of the Thesis . .2 2 Background 4 2.1 Browser Extensions . .4 2.1.1 Firefox Extensions . .5 2.1.2 Extension Security . .7 2.2 Vulnerabilities in Web Applications . .9 2.2.1 Vulnerability Reward Programs and Platforms . .9 2.2.2 XSS Vulnerabilities . 10 2.2.3 XSS Defenses . 12 3 CrossFire: Firefox Extension-Reuse Vulnerabilities 14 3.1 Overview . 14 3.2 Threat Model . 15 3.3 Design . 16 3.3.1 Vulnerability Analysis . 17 3.3.2 Exploit Generation . 19 3.3.3 Example Vulnerabilities . 20 3.4 Implementation . 23 3.5 Evaluation . 23 3.5.1 Vulnerabilities in Top Extensions . 23 3.5.2 Random Sample Study of Extensions . 25 3.5.3 Performance & Manual Effort . 27 ii 3.5.4 Case Study: Submitting an Extension to Mozilla Add-ons Repository . 28 3.5.5 Jetpack Extensions. 30 3.5.6 Implications on Extension Vetting Procedures . 31 3.6 Summary . 31 4 SENTINEL: Securing Legacy Firefox Extensions 33 4.1 Overview . 33 4.2 Threat Model . 34 4.3 Design . 35 4.3.1 Intercepting XPCOM Operations . 36 4.3.2 Intercepting XUL Document Manipulations .
    [Show full text]
  • A Little on V8 and Webassembly
    A Little on V8 and WebAssembly An V8 Engine Perspective Ben L. Titzer WebAssembly Runtime TLM Background ● A bit about me ● A bit about V8 and JavaScript ● A bit about virtual machines Some history ● JavaScript ⇒ asm.js (2013) ● asm.js ⇒ wasm prototypes (2014-2015) ● prototypes ⇒ production (2015-2017) This talk mostly ● production ⇒ maturity (2017- ) ● maturity ⇒ future (2019- ) WebAssembly in a nutshell ● Low-level bytecode designed to be fast to verify and compile ○ Explicit non-goal: fast to interpret ● Static types, argument counts, direct/indirect calls, no overloaded operations ● Unit of code is a module ○ Globals, data initialization, functions ○ Imports, exports WebAssembly module example header: 8 magic bytes types: TypeDecl[] ● Binary format imports: ImportDecl[] ● Type declarations funcdecl: FuncDecl[] ● Imports: tables: TableDecl[] ○ Types memories: MemoryDecl[] ○ Functions globals: GlobalVar[] ○ Globals exports: ExportDecl[] ○ Memory ○ Tables code: FunctionBody[] ● Tables, memories data: Data[] ● Global variables ● Exports ● Function bodies (bytecode) WebAssembly bytecode example func: (i32, i32)->i32 get_local[0] ● Typed if[i32] ● Stack machine get_local[0] ● Structured control flow i32.load_mem[8] ● One large flat memory else ● Low-level memory operations get_local[1] ● Low-level arithmetic i32.load_mem[12] end i32.const[42] i32.add end Anatomy of a Wasm engine ● Load and validate wasm bytecode ● Allocate internal data structures ● Execute: compile or interpret wasm bytecode ● JavaScript API integration ● Memory management
    [Show full text]