Open AccessProceedings Article
Preventing Capability Leaks in Secure JavaScript Subsets.
Reads0
Chats0
TLDR
It is shown that onethird of the Alexa US Top 100 web sites would be exploitable by an ADsafe-verified advertisement and an improved statically verified JavaScript subset that whitelists known-safe properties using namespaces is proposed.Abstract:
Publishers wish to sandbox third-party advertisements to protect themselves from malicious advertisements. One promising approach, used by ADsafe, Dojo Secure, and Jacaranda, sandboxes advertisements by statically verifying that their JavaScript conforms to a safe subset of the language. These systems blacklist known dangerous properties that would let advertisements escape the sandbox. Unfortunately, this approach does not prevent advertisements from accessing new methods added to the built-in prototype objects by the hosting page. In this paper, we show that onethird of the Alexa US Top 100 web sites would be exploitable by an ADsafe-verified advertisement. We propose an improved statically verified JavaScript subset that whitelists known-safe properties using namespaces. Our approach maintains the expressiveness and performance of static verification while improving security.read more
Citations
More filters
Proceedings ArticleDOI
Knowing your enemy: understanding and detecting malicious web advertising
TL;DR: A large-scale study through analyzing ad-related Web traces crawled over a three-month period reveals the rampancy of malvertising: hundreds of top ranking Web sites fell victims and leading ad networks such as DoubleClick were infiltrated.
Proceedings ArticleDOI
ConScript: Specifying and Enforcing Fine-Grained Security Policies for JavaScript in the Browser
TL;DR: ConScript, a client-side advice implementation for security, built on top of Internet Explorer 8, is presented and it is concluded that it is significantly lower than that of other systems proposed in the literature, both on micro-benchmarks as well as large, widely-used applications such as MSN, GMail, Google Maps, and Live Desktop.
Book ChapterDOI
A systematic analysis of XSS sanitization in web application frameworks
TL;DR: A novel model of the web browser is developed and it is found that frameworks often do not address critical parts of the XSS conundrum, showing that there is a wide gap between the abstractions provided by frameworks and the requirements of applications.
Proceedings Article
AdJail: practical enforcement of confidentiality and integrity policies on web advertisements
TL;DR: A novel framework for addressing security threats posed by third-party advertisements is proposed, with an innovative isolation mechanism that enables publishers to transparently interpose between advertisements and end users.
Posted Content
ADsafety: Type-Based Verification of JavaScript Sandboxing
TL;DR: In this article, the authors use a type system for JavaScript to encode and verify sandboxing properties, and demonstrate the effectiveness of their technique by applying it to ADsafe, which revealed several bugs and other weaknesses.
References
More filters
Proceedings Article
GATEKEEPER: mostly static enforcement of security and reliability policies for javascript code
TL;DR: GATEKEEPER is a highly extensible system with a rich, expressive policy language, allowing the hosting site administrator to formulate their policies as succinct Datalog queries, and results in 1,341 verified warnings in 684 widgets, no false negatives, due to the soundness of the analysis, and false positives affecting only two widgets.
Book ChapterDOI
An Operational Semantics for JavaScript
TL;DR: A small-step operational semantics for the ECMAScript standard language corresponding to JavaScript is defined, as a basis for analyzing security properties of web applications and mashups, including a soundness theorem and a characterization of the reachable portion of the heap.
Proceedings ArticleDOI
Subspace: secure cross-domain communication for web mashups
Collin Jackson,Helen J. Wang +1 more
TL;DR: Subspace is a cross-domain communication mechanism that allows efficient communication across domains without sacrificing security, and believes it can serve as a new secure communication primitive for web mashups.
Proceedings ArticleDOI
Characterizing insecure javascript practices on the web
Chuan Yue,Haining Wang +1 more
TL;DR: This paper presents the first measurement study on insecure practices of using JavaScript on the Web, and indicates that safe alternatives to these insecure practices exist in common cases and ought to be adopted by website developers and administrators for reducing potential security risks.
Proceedings ArticleDOI
SMash: secure component model for cross-domain mashups on unmodified browsers
TL;DR: This paper presents a secure component model, where components are provided by different trust domains, and can interact using a communication abstraction that allows ease of specification of a security policy.