Puppetnets: Misusing Web Browsers as a Distributed Attack Infrastructure

被引：5

作者：

Forth-Ics, Spiros Antonatos ^{[1
]}

Akritidis, Periklis ^{[1
]}

Lam, Vinh The

Anagnostakis, Kostas G.

机构：

[1] Univ Cambridge, Cambridge CB2 1TN, England

来源：

ACM TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY | 2008年 / 12卷 / 02期

关键词：

Security; Measurement; Experimentation; Web security; malicious software; distributed attacks;

D O I：

10.1145/1455518.1455524

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Most of the recent work on Web security focuses on preventing attacks that directly harm the browser's host machine and user. In this paper we attempt to quantify the threat of browsers being indirectly misused for attacking third parties. Specifically, we look at how the existing Web infrastructure ( e. g., the languages, protocols, and security policies) can be exploited by malicious or subverted Web sites to remotely instruct browsers to orchestrate actions including denial of service attacks, worm propagation, and reconnaissance scans. We show that attackers are able to create powerful botnet-like infrastructures that can cause significant damage. We explore the effectiveness of countermeasures including anomaly detection and more fine-grained browser security policies.

引用

页数：38