Proceedings 2021 Workshop on Measurements, Attacks, and Defenses for the Web最新文献

筛选

英文中文

First, Do No Harm: Studying the manipulation of security headers in browser extensions 第一，不伤害:研究浏览器扩展中安全标头的操作

Proceedings 2021 Workshop on Measurements, Attacks, and Defenses for the Web Pub Date : 1900-01-01 DOI: 10.14722/madweb.2021.23016

Shubham Agarwal

{"title":"First, Do No Harm: Studying the manipulation of security headers in browser extensions","authors":"Shubham Agarwal","doi":"10.14722/madweb.2021.23016","DOIUrl":"https://doi.org/10.14722/madweb.2021.23016","url":null,"abstract":"—Browser extensions are add-ons that aim to enhance the functionality of native Web applications on the client side. They intend to provide a rich end-user experience by leveraging feature-rich privileged JavaScript APIs, otherwise inaccessible for native applications. However, numerous large-scale investigations have also reported that extensions often indulge in malicious activities by exploiting access to these privileged APIs such as ad injection, stealing privacy-sensitive data, user ﬁngerprinting, spying user activities on the Web, and malware distribution. In this work, we instead focus on tampering with security headers. To that end, we analyze over 186K Chrome extensions, publicly available on the Chrome Web Store, to detect extensions that actively intercept requests and responses and tamper with their security headers by either injecting, dropping, or modifying them, thereby undermining the security guarantees that these headers typically provide. We propose an automated framework to detect such extensions by leveraging a combination of static and dynamic analysis techniques. We evaluate our proposed methodology by investigating the extensions’ behavior against Tranco Top 100 domains and domains targeted explicitly by the extensions under test and report our ﬁndings. We observe that over 2.4K extensions actively tamper with at least one security header, undermining the purpose of the server-delivered, client-enforced","PeriodicalId":296707,"journal":{"name":"Proceedings 2021 Workshop on Measurements, Attacks, and Defenses for the Web","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128234879","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3