2018 IEEE 6th Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE)最新文献

筛选

英文中文

AIEEE 2018 Welcome Message AIEEE 2018欢迎辞

2018 IEEE 6th Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE) Pub Date : 2018-11-01 DOI: 10.1109/aieee.2018.8592451

引用次数: 0

Security Implications of Using Third-Party Resources in the World Wide Web 在万维网上使用第三方资源的安全问题

2018 IEEE 6th Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE) Pub Date : 2018-11-01 DOI: 10.1109/AIEEE.2018.8592057

Karlis Podins, Arturs Lavrenovs

{"title":"Security Implications of Using Third-Party Resources in the World Wide Web","authors":"Karlis Podins, Arturs Lavrenovs","doi":"10.1109/AIEEE.2018.8592057","DOIUrl":"https://doi.org/10.1109/AIEEE.2018.8592057","url":null,"abstract":"Modern web pages have nothing in common with the static connotation coming from the word “page” - it is a dynamic unique experience created by active content and executed within browser, just-in-time assembled from various resources hosted on many different domains. Active content increases attack surface naturally exposing users to many novel threats. A popular security advice has been to deploy active content blocker plugins like NoScript, unfortunately they are not capable to effectively stop the attacks. Content Security Policy (CSP) can be effective against these attacks, but we demonstrate how poor decisions made by website administrators or external resource hosters can render CSP ineffective. As a practical contribution, we have scanned Alexa Top Million web pages for insecure CSP configuration and conducted a follow up scan one year later to observe the changes. Initially only 2% of those web pages were observed to use CSP but in the follow-up the percentage more than doubled. We have found a substantial number of web pages with too loose CSP rules, about 5% of websites that have CSP still enable determined attacker to host malicious content on commercial external resources while fulfilling the CSP rule when exploiting Cross-Site Scripting vulnerability. We also provide a model for the problem domain, formalization of user and domain models, and preferred user security policy.","PeriodicalId":198244,"journal":{"name":"2018 IEEE 6th Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2018-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128947713","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

HTML Block Similarity Estimation HTML块相似度估计

2018 IEEE 6th Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE) Pub Date : 2018-11-01 DOI: 10.1109/AIEEE.2018.8592241

Kiril Griazev, Simona Ramanauskait

引用次数: 1

首页上一页