The Experts below are selected from a list of 21 Experts worldwide ranked by ideXlab platform

Haining Wang - One of the best experts on this subject based on the ideXlab platform.

  • characterizing insecure Javascript practices on the web
    The Web Conference, 2009
    Co-Authors: Chuan Yue, Haining Wang
    Abstract:

    Javascript is an interpreted programming language most often used for enhancing webpage interactivity and functionality. It has powerful capabilities to interact with webpage documents and browser windows, however, it has also opened the door for many browser-based security attacks. Insecure engineering practices of using Javascript may not directly lead to security breaches, but they can create new attack vectors and greatly increase the risks of browser-based attacks. In this paper, we present the first measurement study on insecure practices of using Javascript on the Web. Our focus is on the insecure practices of Javascript inclusion and dynamic generation, and we examine their severity and nature on 6,805 unique websites. Our measurement results reveal that insecure Javascript practices are common at various websites: (1) at least 66.4% of the measured websites manifest the insecure practices of including Javascript files from external domains into the top-level documents of their webpages; (2) over 44.4% of the measured websites use the dangerous eval() function to dynamically generate and Execute Javascript code on their webpages; and (3) in Javascript dynamic generation, using the document.write() method and the innerHTML property is much more popular than using the relatively secure technique of creating script elements via DOM methods. Our analysis indicates that safe alternatives to these insecure practices exist in common cases and ought to be adopted by website developers and administrators for reducing potential security risks.

Chuan Yue - One of the best experts on this subject based on the ideXlab platform.

  • characterizing insecure Javascript practices on the web
    The Web Conference, 2009
    Co-Authors: Chuan Yue, Haining Wang
    Abstract:

    Javascript is an interpreted programming language most often used for enhancing webpage interactivity and functionality. It has powerful capabilities to interact with webpage documents and browser windows, however, it has also opened the door for many browser-based security attacks. Insecure engineering practices of using Javascript may not directly lead to security breaches, but they can create new attack vectors and greatly increase the risks of browser-based attacks. In this paper, we present the first measurement study on insecure practices of using Javascript on the Web. Our focus is on the insecure practices of Javascript inclusion and dynamic generation, and we examine their severity and nature on 6,805 unique websites. Our measurement results reveal that insecure Javascript practices are common at various websites: (1) at least 66.4% of the measured websites manifest the insecure practices of including Javascript files from external domains into the top-level documents of their webpages; (2) over 44.4% of the measured websites use the dangerous eval() function to dynamically generate and Execute Javascript code on their webpages; and (3) in Javascript dynamic generation, using the document.write() method and the innerHTML property is much more popular than using the relatively secure technique of creating script elements via DOM methods. Our analysis indicates that safe alternatives to these insecure practices exist in common cases and ought to be adopted by website developers and administrators for reducing potential security risks.

Jorg Schwenk - One of the best experts on this subject based on the ideXlab platform.

  • scriptless attacks stealing more pie without touching the sill
    Journal of Computer Security, 2014
    Co-Authors: Mario Heiderich, Marcus Niemietz, Feli Schuste, Thorste Holz, Jorg Schwenk
    Abstract:

    Due to their high practical impact, Cross-Site Scripting (XSS) attacks have attracted a lot of attention from the members of security community worldwide. In the same way, a plethora of more or less effective defense techniques have been proposed, addressing both causes and effects of XSS vulnerabilities. As a result, an adversary often can no longer inject or even Execute arbitrary scripting code in several real-life scenarios. In this article, we examine an attack surface that remains after XSS and similar scripting attacks are supposedly mitigated by preventing an attacker from executing Javascript code. We address the question of whether an attacker really needs to Execute Javascript or similar functionality to perform attacks aiming for information theft. The surprising result is that an attacker can abuse Cascading Style Sheets (CSS) in combination with other Web techniques like plain HTML, inactive SVG images, or font files. Having employed several case studies, we discuss so called scriptless attacks and demonstrate that an adversary might not need to Execute code to preserve his ability to extract sensitive information from well-protected websites. More precisely, we show that an attacker can use seemingly benign features to build side-channel attacks that measure and exfiltrate almost arbitrary data displayed on a given webpage. We conclude this article with a discussion of potential mitigation techniques against this class of attacks. In addition, we have implemented a browser patch that enables a website to make a vital determination as to being loaded in a detached view or a pop-up window. This approach proves useful for prevention of certain types of attacks we here discuss.

Mario Heiderich - One of the best experts on this subject based on the ideXlab platform.

  • scriptless attacks stealing more pie without touching the sill
    Journal of Computer Security, 2014
    Co-Authors: Mario Heiderich, Marcus Niemietz, Feli Schuste, Thorste Holz, Jorg Schwenk
    Abstract:

    Due to their high practical impact, Cross-Site Scripting (XSS) attacks have attracted a lot of attention from the members of security community worldwide. In the same way, a plethora of more or less effective defense techniques have been proposed, addressing both causes and effects of XSS vulnerabilities. As a result, an adversary often can no longer inject or even Execute arbitrary scripting code in several real-life scenarios. In this article, we examine an attack surface that remains after XSS and similar scripting attacks are supposedly mitigated by preventing an attacker from executing Javascript code. We address the question of whether an attacker really needs to Execute Javascript or similar functionality to perform attacks aiming for information theft. The surprising result is that an attacker can abuse Cascading Style Sheets (CSS) in combination with other Web techniques like plain HTML, inactive SVG images, or font files. Having employed several case studies, we discuss so called scriptless attacks and demonstrate that an adversary might not need to Execute code to preserve his ability to extract sensitive information from well-protected websites. More precisely, we show that an attacker can use seemingly benign features to build side-channel attacks that measure and exfiltrate almost arbitrary data displayed on a given webpage. We conclude this article with a discussion of potential mitigation techniques against this class of attacks. In addition, we have implemented a browser patch that enables a website to make a vital determination as to being loaded in a detached view or a pop-up window. This approach proves useful for prevention of certain types of attacks we here discuss.

Hammer Christian - One of the best experts on this subject based on the ideXlab platform.

  • A Large Scale Analysis of Android-Web Hybridization
    2020
    Co-Authors: Tiwari Abhishek, Prakash Jyoti, Gross Sascha, Hammer Christian
    Abstract:

    Many Android applications embed webpages via WebView components and Execute Javascript code within Android. Hybrid applications leverage dedicated APIs to load a resource and render it in a WebView. Furthermore, Android objects can be shared with the Javascript world. However, bridging the interfaces of the Android and Javascript world might also incur severe security threats: Potentially untrusted webpages and their Javascript might interfere with the Android environment and its access to native features. No general analysis is currently available to assess the implications of such hybrid apps bridging the two worlds. To understand the semantics and effects of hybrid apps, we perform a large-scale study on the usage of the hybridization APIs in the wild. We analyze and categorize the parameters to hybridization APIs for 7,500 randomly selected and the 196 most popular applications from the Google Playstore as well as 1000 malware samples. Our results advance the general understanding of hybrid applications, as well as implications for potential program analyses, and the current security situation: We discovered thousands of flows of sensitive data from Android to Javascript, the vast majority of which could flow to potentially untrustworthy code. Our analysis identified numerous web pages embedding vulnerabilities, which we exemplarily exploited. Additionally, we discovered a multitude of applications in which potentially untrusted Javascript code may interfere with (trusted) Android objects, both in benign and malign applications