After you, please: browser extensions order attacks and countermeasures
- PDF / 1,050,984 Bytes
- 16 Pages / 595.276 x 790.866 pts Page_size
- 10 Downloads / 155 Views
REGULAR CONTRIBUTION
After you, please: browser extensions order attacks and countermeasures Pablo Picazo-Sanchez1,2
· Juan Tapiador3 · Gerardo Schneider1,2
© The Author(s) 2019
Abstract Browser extensions are small applications executed in the browser context that provide additional capabilities and enrich the user experience while surfing the web. The acceptance of extensions in current browsers is unquestionable. For instance, Chrome’s official extension repository has more than 63,000 extensions, with some of them having more than 10M users. When installed, extensions are pushed into an internal queue within the browser. The order in which each extension executes depends on a number of factors, including their relative installation times. In this paper, we demonstrate how this order can be exploited by an unprivileged malicious extension (i.e., one with no more permissions than those already assigned when accessing web content) to get access to any private information that other extensions have previously introduced. We propose a solution that does not require modifying the core browser engine, since it is implemented as another browser extension. We prove that our approach effectively protects the user against usual attackers (i.e., any other installed extension) as well as against strong attackers having access to the effects of all installed extensions (i.e., knowing who did what). We also prove soundness and robustness of our approach under reasonable assumptions. Keywords Web security · Privacy · Browser extensions · Malware · Chrome
1 Introduction Web browsers have become essential tools that are installed on nearly all computers. The most popular browsers as of this writing (April 2018) are Chrome (77.9%), Firefox (11.8%), Internet Explorer/Edge (4.1%), Safari (3.3%) and This work was partially supported by the Swedish Research Council (Vetenskapsrådet) through the Grant PolUser (2015-04154), the Swedish funding agency SSF under the Grant Data Driven Secure Business Intelligence, the Spanish Government through MINECO Grant SMOG-DEV (TIN2016-79095-C2-2-R) and by the Comunidad de Madrid under the Grant CYNAMON (P2018/TCS-4566), co-financed by European Structural Funds (ESF and FEDER).
B
Pablo Picazo-Sanchez [email protected] Juan Tapiador [email protected] Gerardo Schneider [email protected]
Opera (1.5%) [35]. Most browsers allow users to install small applications, generally developed by third parties, that provide additional functionality or enhance the user experience while browsing. Such plug-ins are known as browser extensions and they interact with the browser by sharing common resources such as tabs, cookies, HTML content or storage capabilities. As of May 2017, the Chrome Web Store1 (the official repository where all Chrome extensions are stored and distributed) contains more than 135,000 extensions, whereas for the case of the second most popular browser (Firefox), its extension store contains almost 70,000 items.2 When an extension is installed, the browser often pops up a message sh
Data Loading...
