Protecting Users by Confining JavaScript with SWAPI Deian Stefan, - PowerPoint PPT Presentation

Protecting Users by Confining JavaScript with SWAPI Deian Stefan, Petr Marchenko, Brad Karp, David Mazières, Dave Herman, and John C. Mitchell

Modern websites are complex

Modern websites are complex

Modern websites are complex Page code

Modern websites are complex Ad code Page code

Modern websites are complex Ad code Page code Third-party APIs

Modern websites are complex Ad code Page code Third-party libraries Third-party APIs

Modern websites are complex Ad code Extensions Page code Third-party libraries Third-party APIs

Modern websites handle sensitive information • Financial data ➤ Online banking, tax filing, shopping, budgeting, … • Health data ➤ Genomics, prescriptions, … • Personal data ➤ Email, messaging, affiliations, …

Many parties are interested in the sensitive data • Financial data ➤ Black-hat hackers, … • Health data ➤ Insurance companies, … • Personal data ➤ Ad companies, big governments, …

Many parties are interested in the sensitive data • Financial data ➤ Black-hat hackers, … • Health data ➤ Insurance companies, … • Personal data ➤ Ad companies, big governments, …

Many parties are interested in the sensitive data • Financial data ➤ Black-hat hackers, … • Health data ➤ Insurance companies, … • Personal data ➤ Ad companies, big governments, …

Many parties are interested in the sensitive data • Financial data ➤ Black-hat hackers, … • Health data ➤ Insurance companies, … • Personal data ➤ Ad companies, big governments, …

How do we protect sensitive data? Non requirements � … information exchange is still more important than secrecy. Tim Berners-Lee, 1989

How do we protect sensitive data? Non requirements � … information exchange is still more important than secrecy. Tim Berners-Lee, 1989 still somewhat true…

How do we protect sensitive data? Non requirements � … information exchange is still more important than secrecy. Tim Berners-Lee, 1989 still somewhat true… but this was before the Web became the platform…


 
 What is the state of the art in web security? • Same Origin Policy • Content Security Policy • Sandboxing 



 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 postMessage a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 postMessage ✓ a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 postMessage ✓ a.com b.com c.com JSON


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 postMessage ✓ JSON a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 postMessage ✓ JSON a.com b.com c.com


 
 
 
 
 Same Origin Policy Idea: isolate content from different origins ➤ E.g., can’t access document of cross-origin page ➤ E.g., can’t inspect responses from cross-origin 
 postMessage ✓ JSON a.com b.com c.com

Same Origin Policy Limitations: ➤ Some DOM objects leak data E.g., image size can leak if user is logged in - ➤ Data exfiltration is trivial E.g., any XHR request can contain data form page - ➤ Cross-origin scripts run with privilege of page ➠ Injected scripts can corrupt and leak user data!


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 a.com c.com


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 a.com b.com c.com


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com JSON


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com JSON


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com JSON


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com JSON


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com JSON


 
 
 
 
 Content Security Policy Goal: prevent and limit damage of XSS attacks 
 Idea: restrict resource loading to a white-list ➤ E.g., default-src ‘self’ http://b.com; img-src * 
 ✓ a.com b.com c.com JSON

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin unq0 ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin unq0 ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin ✓ unq0 ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin ✓ unq0 ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin ✓ unq0 ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 unq1 a.com a.com

Sandboxing Idea: restrict actions page can perform ➤ E.g., directive sandbox allow-scripts 
 ensures iframe has 
 unique origin ✓ unq0 ➤ E.g., directive sandbox 
 a.com a.com ensures iframe has 
 unique origin and cannot 
 execute JavaScript 
 unq1 a.com a.com