Language-Based Defenses Against Untrusted Browser Origins

Abstract : We present new attacks and robust countermeasures for security-sensitive components, such as single sign-on APIs and client-side cryptographic libraries, that need to be safely deployed on untrusted web pages. We show how failing to isolate such components leaves them vulnerable to attacks both from the hosting website and other components running on the same page. These attacks are not prevented by browser security mechanisms alone, because they are caused by code interact- ing within the same origin. To mitigate these attacks, we propose to combine fine-grained component isola- tion at the JavaScript level with cryptographic mechanisms. We present Defensive JavaScript (DJS), a subset of the language that guarantees the behavior integrity of scripts even when loaded in a hostile environment. We give a sound type system, type inference tool, and build defensive libraries for cryptography and data encodings. We show the effectiveness of our solution by implement- ing several applications using defensive patterns that fix some of our original attacks. We present a model extraction tool to analyze the security properties of our applications using a cryptographic protocol verifier.
Document type :
Conference papers
Liste complète des métadonnées

Cited literature [42 references]  Display  Hide  Download

https://hal.inria.fr/hal-00863372
Contributor : Ben Smyth <>
Submitted on : Monday, April 4, 2016 - 2:49:44 PM
Last modification on : Friday, May 25, 2018 - 12:02:06 PM
Document(s) archivé(s) le : Monday, November 14, 2016 - 3:57:07 PM

File

language-based-defenses-agains...
Files produced by the author(s)

Identifiers

  • HAL Id : hal-00863372, version 1

Collections

Citation

Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Sergio Maffeis. Language-Based Defenses Against Untrusted Browser Origins. Proceedings of the 22th USENIX Security Symposium, Aug 2013, Washington, D.C., United States. ⟨hal-00863372⟩

Share

Metrics

Record views

193

Files downloads

79