A Secure Architecture for Untrusted Web Browser Plugins Achim - PowerPoint PPT Presentation

A Secure Architecture for Untrusted Web Browser Plugins Achim Weimert SECT/TU-Berlin March 18, 2011 Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 1 / 21

Outline Introduction 1 Design 2 3 Implementation Evaluation 4 Demo 5 Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 2 / 21

Introduction Web browser: ◮ Display web page ◮ Execute JavaScript Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 3 / 21

Introduction Web browser: ◮ Display web page ◮ Execute JavaScript Plugins: ◮ Extend browser functionality ◮ Provided by third-party ◮ Executed in browser context ◮ Netscape Plugin API (NPAPI) Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 3 / 21

Browser Vulnerabilities Plugins to attack web browser Availability Integrity Confidentiality Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 4 / 21

Browser Vulnerabilities Plugins to attack web browser Availability Integrity Confidentiality Threat model Attacker controls web page, plugin Trusted OS, browser, user Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 4 / 21

Goal Create architecture that... allows for multi-media plugins ◮ low latency ◮ high data throughput ◮ low computation overhead ◮ multiple event sources ◮ threading ◮ prioritization prevents attacks on browser security Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 5 / 21

Design Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 6 / 21

Design Design... ... an interface Checkable information flow ... an architecture Provide interface Enforce interface Facilitate multi-media plugins Overview Execution model, host-client interaction, threading library Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 7 / 21

Execution Model Virtual CPU model (vCPU) Resembles physical CPU Sequential execution model Control flow diversion on events Allows for user level threads Allows for synchronization Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 8 / 21

Execution Model Virtual CPU model (vCPU) Resembles physical CPU Sequential execution model Control flow diversion on events Allows for user level threads Allows for synchronization Host-Client Interaction System calls Events Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 8 / 21

Client Threading Library Multi-threading: ◮ preemption ◮ scheduling ◮ prioritization of events and threads ◮ synchronization Dynamic memory Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 9 / 21

Implementation Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 10 / 21

Implementation Tools Ubuntu Linux 9.10 (64bit) C++ / Assembly Implementation separate from the browser Sandboxing vCPU Preemption Thread priorities Event priorities Synchronization System calls User level resume Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 11 / 21

vCPU System Calls Host waits for client changes using waitpid Segmentation fault at specific address Manipulation of client using ptrace Implemented System Calls exit / sleep / resume / deliver event / get data / display Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 12 / 21

User Level Resume Resume client state without system call high usage of syscall resume repeated switching to host user level implementation ◮ high performance ◮ RET instruction Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 13 / 21

Evaluation Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 14 / 21

Evaluation System Call Roundtrip clock cycles per call time per call relation vCPU ( syscall null ) 37 , 702 ticks ≈ 35 . 671 µs 100 % native (getpid) 248 ticks ≈ 0 . 234 µs 1 % Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 15 / 21

Evaluation cont. Context Switch configuration time per switch relation 1 user level resume ≈ 1 . 0 µs 100 % vCPU 2 syscall resume ≈ 16 . 5 µs 1 , 732 % 3 shared addr. ( clone ) ≈ 2 . 3 µs 237 % 300 % 4 native separate addr. (fork) ≈ 2 . 9 µs 5 separate addr. (clone) ≈ 2 . 9 µs 300 % Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 16 / 21

Evaluation cont. Computation Overhead time relation vCPU 13,733 ms 100 . 0 % native 13,643 ms 99 . 3 % Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 17 / 21

Evaluation cont. Event Latency 10000 Latency of events with parallel data event handling threads 8000 Latency in CPU clock cycles 6000 4000 2000 0 1 2 3 4 5 6 Number of parallel data event handling threads Figure: Latency of events: increasing number of data event handling threads Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 18 / 21

Evaluation cont. Event Latency with parallel events 2.5e+06 Average event latency for HIGH priority handling (1) Average event latency for EQUAL priority handling (2) 2e+06 Average CPU cycles per 100 events 1.5e+06 1e+06 500000 0 0 1 2 3 4 5 Number of parallel data event handling threads Figure: Latency of data events: increasing number of data event handling threads Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 19 / 21

FFmpeg Demo Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 20 / 21

Q & A Thank you! Questions? Achim Weimert (SECT/TU-Berlin) Web Browser Plugin Architecture March 18, 2011 21 / 21